Questions tagged [mobile]
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
1,032
questions
0
votes
0
answers
13
views
Can anyone explain IPv6 geographic locations, as assigned by Verizon? [closed]
I have a co-worker (non-technical workplace), who claims he's being hacked because some of the time his IPv6 locations are in other parts of the country, or in adjacent cities (large metro area).
I'm ...
0
votes
1
answer
42
views
Mobile Application Security
Do we need to carry out separate pentest for apps that are written in language that supports multi platform compilation like fultter? How much value it will bring since backend and major chunk of code ...
- 51
-1
votes
0
answers
13
views
Limiting Mobile Fingerprints For Google?
I run a small agency managing numerous Google accounts and am trying to determine the best route for managing/hiding fingerprints on mobile from Google, outside of good dedicated proxies (which I ...
1
vote
0
answers
16
views
SIM hardware protection of master and long lived keys
4G and 5G authentication procedures includes master keys or long term keys which are shared between subscribers and Home Networks, for 4G they are called Ki.
A case was reported here in which NSA ...
Pietro
1
vote
0
answers
79
views
How does end-to-end encryption work with whatsapp web as of 2022?
The accepted answer to this question is now outdated, since Whatsapp web does not require an online smartphone to function anymore. How is the key exchange performed securely?
- 339
0
votes
0
answers
21
views
What is the 'domain name' in PKCE Auth flow for mobile apps?
I'm interested in building a mobile app that authenticates with a service using OAuth2 so that my app can use their API's. Documentation
To apply for an application key, I need to enter my application'...
0
votes
0
answers
31
views
can an attacker intercept phone call if he has access to my sim?
I read here and here that an attacker, that has physical access to my SIM, card could be able to extract the encryption key from my sim and then intercept and decrypt phone calls. This can be true ?...
- 11
0
votes
0
answers
54
views
Allow the use of camera phones in the manufacturing facilities; but then how do I maintain the security of the premises
What are the best practices to be followed to maintain security in the manufacturing site where camera phones are allowed?
I'm working on one of the largest manufacturing facility where few of the R&...
0
votes
1
answer
90
views
3rd party mobile app access our service via our APIs
We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service.
We have a customer(a company), ...
- 51
2
votes
2
answers
361
views
Understanding Certificate Transparency in Mobile apps and How it Affects Traffic Proxying
I am familiar with the basics of CT and certificate pinning. However, I'm failing to understand how CT properly replaces pinning in mobile apps in a scenario in which, for example, an attacker steals ...
- 23
0
votes
0
answers
48
views
Is using a second hand/grey market phone for banking security a credible risk?
I asked this question in money about telling my bank about using a second hand or grey market mobile phone. The the implication of some of the comments is that any worry is misplaced.
It seems to me ...
- 101
0
votes
0
answers
26
views
What are the pitfalls of adding a corporate eSIM to an unmanaged employee device in lieu of land-line phones?
Instead of having a landline at each employee's desk, allow them to add an eSIM to a compatible personal cell phone. (If possible, disable SMS for the added eSIM so it is acting as a replacement for ...
- 83
0
votes
0
answers
22
views
Does the action of private APIs of iOS need user's manual authentication?
Some iOS apps from my company need to be installed to my iPhone, which are "untrusted enterprise certificate" apps, not from the "app store".
Considering the possible usage of ...
- 131
1
vote
0
answers
70
views
Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]
I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password.
The ...
- 11
0
votes
2
answers
141
views
Malicious SMS and iMessage Interception
I have an interesting situation on my hands. There are people in my neighborhood that have been harassing me for some time now. It appears that these individuals can are receiving my text (sms) ...
0
votes
0
answers
69
views
What are the risks of an unauthorised device connected to a mobile hotspot?
My friend had to activate a mobile hotspot on his iphone for half an hour in an airport to connect his laptop, and suddenly he realized that his device was not the only one connected to it.
What are ...
- 39
3
votes
0
answers
96
views
Security of in-app Forgot Password workflow in Xamarin (Mobile App) without using a website
I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I've seen for any app is:
User requests password reset
...
- 131
0
votes
0
answers
313
views
Decrypt mobile phone app TLS/SSL traffic using Wireshark and Fiddler/Charles/MITM Proxy
I currently use fiddler/Charles Proxy/MITM proxy to decrypt and analyze SSL/TLS traffic from suspect mobile apps I want to analyze. The process I follow is to export a CA cert from Fiddler, then ...
- 1
1
vote
1
answer
113
views
Is it possible to recover data from a bricked smartphone?
I have a smartphone that got bricked last year without warning, and it was deemed unrepairable by multiple repair centers. I did have personal stuff on it.
If I recycle this phone, can someone down ...
0
votes
1
answer
78
views
Block API calls from app to stop DDoS attacks
Recently we had a discussion about the security of a mobile app we are working on. The security team requested that if a user is blocked (due to many failed login attempts), then the back-end should ...
- 1
0
votes
0
answers
31
views
Is it possible to be infected without installing anything like said at the beginning of the video? [duplicate]
It seems like a 'crazy' claim that John McAfee makes at the very beginning of this video, is it true?
"Over half of all smartphones, both iOS and Android are infected with
keystroke logging ...
0
votes
0
answers
100
views
How to check if a speaker can be used as microphone and how to neuter it?
This post: Can a speaker be used as a microphone? mentions that speakers can be used as microphone too it depends on the software and the speaker.
For a modern smartphone, tablet or notebook, is it ...
1
vote
0
answers
141
views
How can I know if phone is already infected?
Last year, my friend who is learning hacking for nearly 3 years hacked my phone using social engineering by installing some malware in my phone. (After researching on Google, I think it might be a ...
- 11
0
votes
1
answer
143
views
What's the threat model of mobile security? [closed]
When reading about mobile security, the attacker is often assumed to have root access to the device, so as to patch the application or proxy all network traffic.
I see that such applications may have ...
- 1,097
1
vote
1
answer
153
views
Do Spier or similar products really hack the phones remotely?
Spier makes lots of claims;
How to Hack Someone’s Phone Remotely
How to Hack Someone’s Phone Without Touching It
We have Signaling System No. 7 (SS7) flaw that can be used to monitor activities, ...
- 5,469
0
votes
1
answer
106
views
When GPS is spoofed in a smartphone, does this affect whatever is being monitored?
When GPS is spoofed in a smartphone, does this affect whatever is being monitored? Suppose I spoof the GPS on my smartphone, such as lazy Pokemon GO players do to play from their couch. Will this ...
0
votes
3
answers
260
views
What to do after opening a potentially malicious link on smartphone?
What must one do if they opened a malicious link?
Warning: Please do not open the links below as they may be malicious. They have been deliberately mangled to prevent accidental opening
I received an ...
- 1
1
vote
0
answers
110
views
iOS: What are potential privacy issues with Intune device enrollment?
I work at a large corporation and don't know how the mobile device management (MDM) is configured (and also the settings can be changed dynamically).
I have a personal iPhone and the employer wants me ...
- 1,413
0
votes
0
answers
73
views
Escrow Key required after restart (Macbook Air M1) (MDM)
I have Macbook Airs (M1; Big Sur) that even though they successfully enable FDE to a local user, after restart, the device requires the escrow key.
The Airbooks are managed by an MDM which pushes the ...
1
vote
2
answers
181
views
Scanning for malicious hardware on display replacement for a smartphone
I recently bought a replacement display for my smartphone on ebay from a national supplier.
I later realized that it does not have the Huawei logo printed on it, but it is working fine.
There were ...
- 11
1
vote
1
answer
171
views
Avoiding carrying my main SIM card
In many countries, for example, Russia where I live, you need to show an ID to obtain a SIM card. Often this is used by law enforcement to track people. Sometimes corrupt officers sell people's ...
- 11
1
vote
1
answer
175
views
Protecting a PWA authentication token on a public kiosk device
I have a use case where I need a factory-reset tablet device to install and run a simple Progressive Web Application (PWA). The tablet will be mounted on a wall inside a company building that may host ...
- 113
0
votes
1
answer
166
views
Should certificate pinning be implemented if the app can use many servers?
In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application.
The vendor sells software that it's customers ...
- 33
4
votes
2
answers
1k
views
IoCs of Pegasus spyware penetration
What are the indicators of compromise (IoCs) that indicate methods used by the Pegasus spyware on mobile phones?
How is penetration still possible when the latest and up-to-date OS of the phone is ...
- 560
0
votes
0
answers
232
views
Someone connected to my hotspot. Are my phone and laptop now compromised?
I have been using my android phone as a wifi hot spot for my laptop over the last few days so I can access the internet. I've been in a new location with no other personal devices nearby, and the hot ...
- 195
1
vote
1
answer
257
views
How to do ADB and user activity logging on Android?
My question is how to detect ADB connection or unusual user activity in shell on the Android devices.
I have an Android 5.1.1 device with Wi-Fi hotspot enabled and also with opened ADB port, similar ...
- 260
2
votes
1
answer
557
views
What is Trusted Credentials in mobile phones?
My phone is encrypted and i was just playing with the configuration and just found a Trusted Credentials that got me curious on what it is and specially in one called Government Root Certification ...
0
votes
2
answers
164
views
How easily can ISP/mobile network operator employees read or decode traffic data?
When I sign up for a mobile subscription or internet connection with my ISP (also a mobile network operator), the company's privacy policy says that certain information is processed such as personal ...
- 51
0
votes
1
answer
265
views
Will GPS spoofing + VPN on mobile hide location?
Suppose I turn on "developer" mode on my Android mobile phone and install a professional GPS spoofing app and a professional VPN app. Developer mode will allow the GPS spoofing app to ...
- 115
1
vote
0
answers
97
views
Is Google OAuth login in 3rd party applications via system browser secure?
Numerous mobile applications allow me to "Login with Google".
From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
- 153
1
vote
2
answers
153
views
Are high traffic apps and websites used in DDoS attacks?
Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
0
votes
2
answers
249
views
Is it possible to compromise a mobile phone just by using the telephone number?
In a recent tweet, a prominent UK journalist has claimed to have witnessed a European police force accessing content on a mobile phone just by using the telephone number.
https://twitter.com/krishgm/...
- 131
0
votes
1
answer
119
views
If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?
I have some questions about certificate pinning.
Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
- 1
1
vote
1
answer
452
views
Verifying hardware-backed key pairs with Key Attestation
I am currently working through the Android tutorial about implementing Key Attestation. The tutorial can be found here: https://developer.android.com/training/articles/security-key-attestation
In the ...
- 43
1
vote
1
answer
260
views
Manage API key on mobile platform
As I am currently working a lot with mobile applications a question arised:
How to properly store and transmit API keys within mobile applications?
When I analyze mobile applications most of the times ...
- 228
1
vote
0
answers
80
views
I am finding the following link on my mobile past option once I restart or power on, any one knows what is it? [closed]
I am finding the following link on my mobile past option once I restart or power on, any one knows what is it?
e-zfas5x9ao:...
- 11
1
vote
1
answer
85
views
Standard Protocols or secure mechanism to authenticate users offline
We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
9
votes
1
answer
2k
views
Certificate Pinning Best Practice or Alternative
I'm looking for the "best practice" to use in Certificate Pinning or an Alternative.
Scenario: I have a native mobile app and I have pinned the certificate so that the app can validate ...
- 165
1
vote
1
answer
510
views
How do I maintain/check a user session in the backend without having to use tokens?
I'm trying to login a user and, then, retrieve the user information like we do on a regular web app using php session.
I have searched some solutions but I couldn't find any answer for my problem/...
- 13
4
votes
4
answers
521
views
Is 2FA a false sense of extra security on a mobile phone?
I understand that 2FA increases security if you are using two different devices, for instance a computer and a mobile phone.
I fail to understand how these security measurements help if you are doing ...
