Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
0
votes
3answers
102 views
Should I block a user from using banking app if they fake the location?
I was wondering if this could be a security issue for banking application and if so, why? What are the risks if I allow it?
1
vote
2answers
54 views
Protecting payment mobile app against mobile theft
Currently I'm designing a payment app.
It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
1
vote
0answers
73 views
What data is bitmoji keyboard collecting about me?
Bitmoji is a virtual keyboard for iOS and Android to create personalized emojis (very paraphrased). I've found a few blogs looking at the permissions it requests and the privacy policy that it shares ...
1
vote
2answers
116 views
Can infection effect a phone through it's wireless hotspot, also the usb tethering
If I made a wireless hotspot from my phone and had computers infected with malware connect and use my wireless connection of the phone can any malware from the pc get into the phone?
If my phone was ...
0
votes
0answers
59 views
All smartphone ports filtered - how to scan smartphones on local Wifi?
I am using Nmap and scanning my smartphone (LG G5 - Android) on my local network and practicing trying to gain remote access into it. However, whenever I scan my cellphone, either all ports are closed ...
3
votes
1answer
52 views
Call and Unsolicited One Time Passwords
Context:
I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
0
votes
0answers
21 views
How is it possible that a webpage can have access to my number if I open the page from my mobile? [duplicate]
While browsing on my mobile, I clicked on an ad and shortly after I received a text saying that I had been subscribed to a service and that to unsubscribe I had to send a text.
This was over a year ...
0
votes
1answer
84 views
Can malware be installed on a mobile phone when the user opens an sms?
Is it possible for an adversary send malware over messages? I mean, when the victim clicks on the message sent by the attacker, a malware should be installed into his phone (in background). The hacker ...
2
votes
1answer
65 views
Identify anonymous mobile phone user by network participants
I have wondered this for quite some time but have not found any references. In the TV series "The wire" they use disposable prepaid mobile phones as a counter-surveillance technique. However if ...
3
votes
0answers
140 views
How secure are IMEI numbers?
I recently had my phone stolen (Galaxy S8) and have done the following:
Wiped it remotely
Reported the theft to network operator, who have allegedly blocked the EMEI
I have tried searching for ...
0
votes
2answers
74 views
OTP generation is specific to SIM or Phone number
Are the messages including OTP sent to a mobile phone addressed to the SIM card or the phone number?
If I decide to have a new phone number and the old phone number is allotted to a new customer, the ...
1
vote
1answer
83 views
Is showing the package name(Android)/bundle ID(ios) a security risk?
Suppose I release an app and accidentally publish the package name/bundle ID of the app which is suppose to be shown in development only, in a page. Is there any security concern that arises from this?...
0
votes
1answer
45 views
How does TrueVault's de-identification process work?
I'm thinking of using TrueVault, but I'm not entirely sure about the sequence of events involved in de-identifying data and re-identifying it. More info here. Here is the process, as I understand it, ...
2
votes
0answers
31 views
What is the right end-to-end process for transmitting/computing w/ HIPPA-compliant data?
Not a security expert so please excuse what may be a basic question. I am creating a health app that needs to be HIPPA compliant. I will of course hire a consultant later on, but I need a feel for how ...
4
votes
1answer
66 views
How is this registration setup vulnerable?
I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
60
votes
11answers
21k views
Why don't websites and devices offer fake logins for hackers?
I was thinking about this earlier this morning and was wondering why websites and devices don't offer fake logins for hackers? What I mean by that is that if a hacker finds out some of your details ...
1
vote
1answer
205 views
OAuth2 for mobile apps with confidential backend client (Is PKCE required?)
I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
0
votes
0answers
73 views
Securing mobile app API Using UDID and Argon2
I'm trying to build an iOS app, I have wrote the code and all, and now I am implementing the APIs to communicate with the database.
The app will be using HTTPS and POST Requests to communicate with ...
3
votes
3answers
215 views
Why don't mobile devices let you change the IMEI number for better anonymity?
The vast majority of modern day mobile devices have a fixed IMEI number that's impossible to change, which makes it easy to track people if they use the same device constantly. It's quite easy to swap ...
2
votes
1answer
83 views
Can Signal encrypted voice calls be listened into by other apps?
Signal App (by Open Whisper) provides encrypted voice calls allowing two people to communicate via a data connection with secure encryption (assuming no MiTM attack). Given that Signal App uses the ...
0
votes
0answers
19 views
Protecting API - Using 3rd party? or Application Firewall? [duplicate]
Our company has a mobile app with a lot of traffic and we want to protect its API.
How can we reduce brute force attacks?
Does account lockout is the fastest and proper way to achieve protection?
We ...
1
vote
1answer
80 views
Shoulder surfing prevention or mitigation for unlocking mobile devices
How can shoulder surfing be prevented or mitigated when unlocking mobile devices?
I found other questions about shoulder surfing that focus more on desktop machines, but I believe the issue is much ...
5
votes
1answer
137 views
Do app lockers improve smartphone security?
I recently installed Norton App Lock on my smartphone. It asks for a password pattern every time one tries to open an app. So, theoretically, it protects you in case someone is able to bypass your OS ...
1
vote
0answers
28 views
Restrict Public API To Access From Single App
I have a REST api on a server and an application for android phones that mostly makes calls to that api and presents the info to the user.
Because the application needs to be a quick way to lookup ...
1
vote
1answer
60 views
somewhat complex dev domain https on local network cert problems
I was trying to mirror my setup to prod as much as possible so I only serve my dev site over https. The setup goes like this...
I have a trusted CA on my machine made by devcert
I generated some ...
1
vote
1answer
55 views
Outlook service is storing decrypted password in server memory – how insecure is it?
I am evaluating the possibility of using Outlook mobile client with an on-premise Exchange 2013 server. However it seems that the app sends quite a bit of data to Microsoft's cloud servers. It also ...
4
votes
3answers
203 views
Is it possible to identify mobile phone user with voice recognition
A friend of mine claims that it is possible to identify every anonymous call (prepaid, skype, etc) only using voice recognition. However the scientific literature which I've read so far is ambiguous, ...
1
vote
0answers
60 views
Password reset link was delivered via text not email, how and why? Any insight is appreciated [closed]
I think my smartphone is being hacked into + controlled by a third party, possibly my internet connection as well. Some very odd things have been ongoing for many months. On my phone I hear constant ...
0
votes
1answer
25 views
Privacy issue on corporate device
On my corporate phone which has my Exchange account. Browsing incognito on my home WiFi. Can my employer find out what I am browsing on an incognito page? I am using am iPhone.
0
votes
3answers
147 views
If you phone is seized, can you erase sim or stop them from cloning?
If your phone (for example, an iPhone) gets seized by the police, do they have sufficient technology to copy sim card (or any data) even if you cancel you provider and put phone in lost mode? If so, ...
1
vote
1answer
54 views
Long lived auth session for native mobile app
I’m working on mobile app which should have both good security and UX.
My backend stores credentials on its side. There is no 3rd-party auth services. Also the app shouldn’t have web views as part of ...
1
vote
1answer
119 views
Can location/owner of mobile phone be identified
Let's say someone uses GSM network mobile phone to pursue his/her online activities on social networking platforms. The mobile phone is Android and all online activities are done through a VPN tunnel (...
1
vote
1answer
593 views
How to prevent “JailBreak detection bypass” by Cydia tools such as “Flex 3” etc?
For sensitive mobile apps such as banking applications, it is recommended to detect if the device is JailBroken and prevent the application from working on that device.
But there are tools such as "...
2
votes
2answers
67 views
Self-signed certificates in mobile and desktop applications - are they enough? [duplicate]
I want to secure my data transfer using TLS between my own mobile and desktop client applications and my server. I am not at this time interested in web-based applications, so I don't really care that ...
2
votes
0answers
77 views
Apple iOS and KRACK
KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
1
vote
1answer
81 views
What would be the best way to authenticate a user in an offline, multi-user mobile environment?
I'm currently working on an offline authentication system for a multi-user mobile environment.
In order to avoid storing all passwords locally, which seems to be a bad idea, I proceed this way:
A ...
0
votes
3answers
185 views
Token FIPS 140-2 level 3 with support for Android, iPhone and Web
I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines.
I would like to create applications that use level 3 tokens. Is ...
3
votes
0answers
239 views
What unique device fingerprinting information can an iOS 11 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
3
votes
1answer
110 views
Should I allow or block wireless devices from directly communicating with each other on my LAN AP?
The question I'm asking is, like all security, a bit open-ended, and ultimately - like all security - it involves a personal balance between ease/usability vs. risk/security:
Should I let users' ...
1
vote
0answers
30 views
What are the security risks for applications using Cordova's webview on mobile?
I'm creating hybrid apps in Cordova. It creates a webview and renders HTML/JS/CSS content inside it on mobile phones, making it look like an app, but really it's just a local web page.
Now I'm a bit ...
1
vote
1answer
72 views
Securing .so file access permissions
I work for a place that offers an encryption suite for Android apps in the form of a .so C library to be integrated in Android apps.
The issue is that there is only two exported functions in the .so ...
-5
votes
1answer
108 views
How to load spyware through a text?
How is it possible to load spyware through a text or phone call? The target phone is always password protected.
0
votes
0answers
207 views
Why do some mobile apps keep me logged in and other apps log me out?
I have some mobile banking apps on my iPhone - and I have to login everytime I want to use the app. I also have another app from a different financial institution that keeps me logged in. I only had ...
5
votes
3answers
152 views
Problem with the security certificates on parents' WiFi
I went to my parent's house for Easter and my cousin asked me about why he started getting certificate errors on his iPhone. I didn't think much of it until I went to show my family an Android ...
0
votes
0answers
255 views
Android: Can you exploit a broadcast Receiver that receives a custom object from the intent?
The app I am trying to attack (under a legitimate bug bounty program of course) has the following code for its broadcast receiver:
//From vulnerable app
public void onReceive(Context paramContext, ...
75
votes
5answers
15k views
I gave my cell number to a stranger on the internet. Have I fallen victim to a scam?
I was playing an online game and I came in contact with this user. She was listed as from the same country as me (Egypt). So when she asked me for my cell phone number, I gave it to her. I figured it ...
67
votes
10answers
18k views
Should I be concerned about strange, new iPhone app appearing after repair?
I had my iPhone battery replaced in a phone repair shop. After collecting it, I noticed that there is a strange new app installed, some "Chinese" web browser. It has no alphanumeric name and nothing ...
-1
votes
2answers
87 views
Can it be traced that I connected to wifi after I have disconnected?
Yesterday I connected to the wifi at a friends house through my cellphone. After I have disconnected, can it ever be traced that I used the wifi?
0
votes
3answers
178 views
Is it possible to identify my cellphone model if I connect to wifi?
Would it be possible for the IT department to trace the model of my cellphone if I connect to the wifi provided by the company?
0
votes
2answers
141 views
Can lack of certificate pinning be considered a vulnerability?
The use of certificate (or public key) pinning can be considered as a good practice for defense in depth, since it protects an application from man in the middle and DNS hijacking attacks. But can it ...
