Questions tagged [mobile]
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
1,007
questions
0
votes
1answer
48 views
Should certificate pinning be implemented if the app can use many servers?
In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application.
The vendor sells software that it's customers ...
4
votes
2answers
182 views
IoCs of Pegasus spyware penetration
What are the indicators of compromise (IoCs) that indicate methods used by the Pegasus spyware on mobile phones?
How is penetration still possible when the latest and up-to-date OS of the phone is ...
0
votes
0answers
108 views
Someone connected to my hotspot. Are my phone and laptop now compromised?
I have been using my android phone as a wifi hot spot for my laptop over the last few days so I can access the internet. I've been in a new location with no other personal devices nearby, and the hot ...
1
vote
1answer
138 views
How to do ADB and user activity logging on Android?
My question is how to detect ADB connection or unusual user activity in shell on the Android devices.
I have an Android 5.1.1 device with Wi-Fi hotspot enabled and also with opened ADB port, similar ...
0
votes
1answer
75 views
What is Trusted Credentials in mobile phones?
My phone is encrypted and i was just playing with the configuration and just found a Trusted Credentials that got me curious on what it is and specially in one called Government Root Certification ...
0
votes
2answers
72 views
How easily can ISP/mobile network operator employees read or decode traffic data?
When I sign up for a mobile subscription or internet connection with my ISP (also a mobile network operator), the company's privacy policy says that certain information is processed such as personal ...
0
votes
1answer
96 views
Will GPS spoofing + VPN on mobile hide location?
Suppose I turn on "developer" mode on my Android mobile phone and install a professional GPS spoofing app and a professional VPN app. Developer mode will allow the GPS spoofing app to ...
1
vote
0answers
47 views
Is Google OAuth login in 3rd party applications via system browser secure?
Numerous mobile applications allow me to "Login with Google".
From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
1
vote
2answers
94 views
Are high traffic apps and websites used in DDoS attacks?
Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
0
votes
0answers
77 views
Dangers of switching sim from old phone to new one
I would like to know the dangers of switching an old sim card from an old phone to a new one. I recently got a new phone and a paranoia woke in me. Lets assume that the old phone was infected with ...
0
votes
0answers
43 views
What level of PCI compliance is required, and who is responsible for having it, where a white label app is involved?
We have developed a mobile application that integrates with systems of record of our clients via a middleware application.
This application, amongst other things, can integrate with product systems ...
0
votes
0answers
33 views
Figure out security and auth for mobile app which uses Firebase
I need a bit of help to figure/plan out this scenario:
So for a mobile app I'm currently working on, the use case requires authenticating users via mobile number and OTP. So basically the user enters ...
0
votes
2answers
160 views
Is it possible to compromise a mobile phone just by using the telephone number?
In a recent tweet, a prominent UK journalist has claimed to have witnessed a European police force accessing content on a mobile phone just by using the telephone number.
https://twitter.com/krishgm/...
0
votes
1answer
49 views
If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?
I have some questions about certificate pinning.
Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
1
vote
1answer
105 views
Verifying hardware-backed key pairs with Key Attestation
I am currently working through the Android tutorial about implementing Key Attestation. The tutorial can be found here: https://developer.android.com/training/articles/security-key-attestation
In the ...
1
vote
1answer
87 views
Manage API key on mobile platform
As I am currently working a lot with mobile applications a question arised:
How to properly store and transmit API keys within mobile applications?
When I analyze mobile applications most of the times ...
1
vote
0answers
43 views
I am finding the following link on my mobile past option once I restart or power on, any one knows what is it? [closed]
I am finding the following link on my mobile past option once I restart or power on, any one knows what is it?
e-zfas5x9ao:...
1
vote
1answer
45 views
Standard Protocols or secure mechanism to authenticate users offline
We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
7
votes
1answer
591 views
Certificate Pinning Best Practice or Alternative
I'm looking for the "best practice" to use in Certificate Pinning or an Alternative.
Scenario: I have a native mobile app and I have pinned the certificate so that the app can validate ...
1
vote
1answer
93 views
How do I maintain/check a user session in the backend without having to use tokens?
I'm trying to login a user and, then, retrieve the user information like we do on a regular web app using php session.
I have searched some solutions but I couldn't find any answer for my problem/...
1
vote
4answers
313 views
Is 2FA a false sense of extra security on a mobile phone?
I understand that 2FA increases security if you are using two different devices, for instance a computer and a mobile phone.
I fail to understand how these security measurements help if you are doing ...
1
vote
0answers
122 views
Should I occasionally replace my SIM card for security reasons?
To be able to use mobile data (e.g. 4G/ LTE) and mobile telephony (e.g. VoLTE) services on my smartphone, I need to put a SIM card into my smartphone (I know embedded-SIM/ eSIM exists but let's ignore ...
0
votes
0answers
35 views
Secure Mobile Deeplink login with SAML (Android, iOS)
We want to use deeplink with a schema to login using SAML in our Mobile Apps:
i.e
ourschema://host?code=12345
The problem is that other apps on iOS can read the content of ourschema:// including the ...
2
votes
1answer
94 views
What are the threat models that using a VPN for mobile data can mitigate?
Some VPN providers offer to encrypt mobile data. This goes beyond the typical Wifi hotspot mitigation paradigm.
So what exactly are the benefits of VPN over mobile data? What threat models can this ...
0
votes
1answer
50 views
What are modern protections against mobile application cloning
I recently started thinking about an attacker which would clone a mobile application, and add some code which would do something malicious, e.g. credential theft. This cloned app would communicate ...
0
votes
0answers
45 views
Storing account data on device
I am trying to make an app that allows the user to connect to a service through an API I am also developing. All passwords and account data are securely stored on the server.
However, how should I ...
0
votes
0answers
50 views
Trying to defend against Cell site simulators
I take a phone, insert a SIM Card in it, then connect it to the internet. Then I switch on Wi-Fi Hotspot on it.
Then I connect a second phone to the Hotspot of the first phone, and use this first ...
0
votes
1answer
250 views
Hiding ip address when using coinomi wallet
How do I hide my ip address if I use a wallet as coinomi? Do I have to use Orbot? If yes, what exactly should I do? (I'm using it from an android) I just want to have privacy when I log into the ...
0
votes
1answer
156 views
Secure REST API for mobile and web application usage
I have been reading about authentication and authorization for the past few days and I still have not figured out what would be a reasonable way to deal with this for both mobile and web applications.
...
1
vote
1answer
76 views
What is the risk of using Windows Phone 8.1 now?
My friend uses Microsoft Phone 8.1 mobile for a tax accountancy firm. As it hasn't received security updates for five years I believe that is a significant information security risk. However, the ...
0
votes
0answers
58 views
Using application encryption instead of relying on HTTPS
I use Google Firebase Services. I am thinking about using only https on mobile to send and receive a payload from my server. I will have RSA encryption with a public key on all clients. So when a ...
0
votes
0answers
53 views
Using shared email account to sign in to testing devices
A company I work with has a number of mobile devices that are used primarily for testing apps and websites.
I have advised that to improve security it would be best for each device to be assigned to a ...
1
vote
0answers
57 views
Storing cleartext password in iOS keychain
I'm having a webservice which I'm using for my app. The webservice is using cookies when authenticated. I want to give my users the option to login via TouchID for faster login. Therefore I'm storing ...
56
votes
10answers
15k views
Is it really safe to use Signal or Telegram on untrusted phone hardware?
How safe are we when we use phone hardware from untrusted manufacturers and use end-to-end encrypted communication like Signal and Telegram? Are our conversations really safe from keyloggers or ...
1
vote
2answers
878 views
How to spoof IMEI/SIM location?
Once you plug it into a phone and power it on, the IMEI number of the
phone and the SIM's serial number will be transmitted to the nearest
cell tower(s).
source
Is there a way to spoof the location ...
0
votes
0answers
52 views
Integrating 2FA app into main app
We currently have two distinct apps, one for generating a 2FA token and the other one is the main app. Business is now considering to have only one app left and integrating the authenticator app into ...
0
votes
1answer
91 views
'New vintage' Nokias privacy/anonymity
I have read that devices such as the old Nokia 8310 are used because the privacy/anonymity they provide (for instance for drug dealers)
I have tried to find out if the 'new' vanilla Nokias, such as ...
-1
votes
2answers
225 views
Ensure Http request comes from a Android/IoS mobile app to server? [duplicate]
Say I build a mobile app. For the sake of the example, the app is an Android App and let's call it the Client
And this mobile app communicates with a server application. For the sake of this example, ...
3
votes
1answer
365 views
MSTG-PLATFORM-11: Prevent custom third-party keyboards on Android?
The MASVS states in section "V6: Platform Interaction Requirements" MSTG-PLATFORM-11:
Verify that the app prevents usage of custom third-party keyboards whenever sensitive data is entered.
...
-2
votes
3answers
135 views
Calling from mobile phone without using the cellular network
This has been in the news:
https://www.wired.com/story/fcc-fines-wireless-companies-selling-users-location-data/
Is there a way to make calls without using cell towers?
Also in this context: is it ...
2
votes
1answer
112 views
How is SIM blocking enforced?
The only protection features that mobile phones have to keep thieves that stole a target's device from impersonating that subscriber is the PIN/PUK system that's on by default on most SIM cards.
The ...
1
vote
2answers
256 views
Why are IMSI and IMEI still used?
While I understand their function, both IMSI and IMEI makes tracking and surveillance possible by virtue of being persistent idenfitiers for SIM and handset, respectively.
Why aren't these replaced ...
2
votes
2answers
526 views
Can we use CORS policy to restrict API calls from native mobile app?
We can use CORS to restrict API calls to a specific host in a web app. How to do the same for native mobile app?
I want to restrict API calls from my app alone.
Is it possible to do so?
0
votes
2answers
163 views
Safe mobile browsing
What actions can I take to make web browsing on mobile phone (android) as safe as possible? My main concern are sites that would install malware (has happened before on desktop computer). On a ...
83
votes
8answers
12k views
Do advertisers listen as we talk?
A person talks about a certain thing (product or service) with another person and a short time after the talk the person gets the advertising of the discussed thing on the mobile or desktop device.
I ...
3
votes
1answer
241 views
MSTG-ARCH-7: All security controls have a centralized implementation
In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation".
Now I'm struggling a bit by what ...
4
votes
0answers
179 views
Deauthorization Bug in messenger application - How serious is this?
My question refers to a behavior on a production system with more than 100 million chat users.
Some time ago I changed my account password and removed all devices connected to my account.
The next day ...
0
votes
1answer
127 views
Massive operational security hole
Everything is based on phones now. If I have someone's phone I can reset their Salesforce password, access any SAS services etc.
Assume this
Hacker finds someone's phone number
Hacker buys (or works ...
2
votes
1answer
494 views
Is inputting credit card numbers over a mobile phone secure?
I'm in the UK. In order to top up a pay-as-you-go SIM card, I had to first ring the mobile network to associate my bank card with the SIM before asking them to credit £10 to it (future top-ups don't ...
18
votes
3answers
5k views
Is cell phone number based verification secure?
Websites often send a code to a cell phone number for verification. Is this secure? If it is not secure, are there any better alternatives?
