Questions tagged [mobile]
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
0
votes
0answers
13 views
Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?
I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
1
vote
0answers
50 views
Fuzzing of Mobile Applications
I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz.
I searched on ...
6
votes
1answer
191 views
Will two smartphones (identical hardware and software) generate the same canvas fingerprint?
When using Canvas Fingerprint (like on this website) to distinguish users, does two smartphones (same model, same OS version, and no browser/plugin customization) will share the same fingerprint?
0
votes
1answer
40 views
How do JavaScript (and mobile) APIs keep user data clean?
Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
0
votes
1answer
27 views
Revoke OAuth2 Token For Mobile App
When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an ...
3
votes
3answers
204 views
A protocol for encrypting the data on the server, but with a password on a mobile device
I want to implement the following encryption scheme. The data is created and stored on a web server, but related to some user of the system (i.e. it is entered "on behalf" of the user). Both ...
1
vote
0answers
45 views
Android WebView JavaScript Enabled
I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
0
votes
0answers
33 views
Current generally recommended minimum Android API level for security reasons (Late Dec 2018) [closed]
I am currently reviewing some Android application build hardening guidelines which specify a minimum allowable supported API level. This was set internally at API level 15 and has been for some time, ...
0
votes
1answer
21 views
Basic Auth Credentials on Mobile Device
I am testing a mobile app that makes requests to a web service. Web service has two sets of functions. Class A functions can be called before login and Class B functions can be called after login. ...
2
votes
0answers
56 views
Can (the carrier of) a caller/callee see the position of the other ones mobile phone?
Someone came to me with the following request:
He/She wants to drive somewhere without the employer knowing in his/her free time. If the employer will know about the drive, it will be bad for his/her ...
4
votes
2answers
126 views
Upload malware to F-Droid repo?
What's the auditing/vetting process like to get an Android app into the F-Droid repository? To ask it another way, what's to stop an evil developer from uploading a backdoored Android app to the F-...
2
votes
2answers
75 views
How to protect API endpoint from abuse in mobile App?
Let's assume I have a mobile app that fetches the news feed from an url on my server.
GET/ https://example.com/api/v1/newsfeed
Is there a way to restrict the access to this endpoint to only from ...
1
vote
2answers
97 views
Prevent Text Spoofing - Best methods
In an enterprise environment we have been inundated with spoof texts appearing to be from the corporate office.
After much research it appears Verizon isn't able to assist. Just wondering if anyone ...
3
votes
0answers
70 views
What is the most secure NFC Encryption system? [closed]
What are the best ways for NFC (Near-field communication) encryption with high level of security?
Basically, I am interested in having an NFC which can only be read/authenticated with a mobile app/...
2
votes
0answers
50 views
Risk that apps with access to your saved files and camera roll get a hold of all your saved files and photos [closed]
Since I made pictures of some documents that should never be released to the public I was wondering how high the risks actually are, that the pictures I made have been "saved" by some of my apps, or ...
8
votes
3answers
226 views
Is a second, “old” (dumb) phone dedicated just to receiving bank tokens as safe as “modern” (smart) phone?
Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens?
Is SMS encrypted?
1
vote
3answers
177 views
How to prevent unauthorized users from accessing an image on my server just by URL?
I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
2
votes
0answers
39 views
How to give end users access to accounts previously only administered by managers?
I have a question about how to handle a somewhat unique authentication situation.
We have an existing system with lots of users that have never had direct access to their accounts before. They have ...
0
votes
1answer
165 views
4G Pocket WiFi - IMSI Catcher?
Nearly all mobile phones are vulnerable to IMSI catcher attack's fake mobile networks. They can access storage, inject rootkits/backdoors, turn the microphone on view internet traffic even with a VPN ...
4
votes
1answer
91 views
GSM - Implementing Cipher Mode Command on YateBTS
I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!?
I use the combination of BladeRF x40 FPGA and ...
0
votes
1answer
93 views
Does the device you are logging into count as one of the factors for MFA when you are using device biometrics? [duplicate]
Yes it does because
I 'have' the physical device
I 'am' the owner of the fingerprint
But no it doesn't because
1=>2 : If you have my device the fingerprint is now something you can get.
Which ...
0
votes
2answers
424 views
JWT or session cookie for API for both web and mobile app?
I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach.
The only two requirement are:
I need to know the users that are ...
0
votes
1answer
98 views
Can smartphone app be hacked by wifi?
We all know that it is possible to spy on other people in the same wifi network, even if it is difficult.
What about apps, like Facebook app for Android? Is it similar to an https website so it is ...
1
vote
0answers
48 views
What are the security implications of using an iPhone purchased in China
I recently bought an iPhone off Craigslist, but It's come to my attention that the phone was purchased by it's original owner in China (The model no is: A1528). Are there any security implications if ...
-1
votes
0answers
66 views
OAuth 2 Client Credentials within Mobile App
I am currently developing a mobile app that communicates with an OAuth server. The server I am trying to access provides two grants: Authorisation Code and a device PIN grant (not sure if it's part of ...
-1
votes
1answer
103 views
Surveillance by mobile network provider
I am customer of Vodafone Germany as my mobile network provider. After extension of my RED S mobile contract i realized, that the option "Vodafone Secure Net" is enforced by the company without ...
0
votes
1answer
109 views
Fake bank text message
I recently tried to use my card to buy something on my phone for £29.99. My card was declined so I used a different card and the payment went through.
A couple minutes later I get a message from a ...
513
votes
18answers
107k views
Police forcing me to install Jingwang spyware app, how to minimize impact?
Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it.
Knowing that I may be ...
1
vote
1answer
65 views
Mobile application authentication using UUID
I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is:
When user signs in, device sends username and ...
0
votes
1answer
196 views
Mobile call encryption [duplicate]
Is the signals of a mobile phone-call encrypted between the phone and the mobile-tower or only between the towers? And is it possible for a non-authority individual to eavesdrop on your conversation ...
25
votes
6answers
5k views
Why do apps with phone verification send the user a message, rather than have the user send one to them?
Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
0
votes
2answers
96 views
What tests can be performed on mobile apps to determine if they are secure?
My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
3
votes
2answers
149 views
Authenticate user based on mobile device identifier
I have a hypothetical mobile game where players don't necessarily need to create accounts to play. Their data is keyed off of a device identifier like an advertising identifier (IDFA) or Apple's ...
0
votes
1answer
151 views
Is there a way to secure an API key on iOS?
When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite ...
1
vote
0answers
70 views
How do third party providers remove the SIM lock on a mobile phone?
There are third party providers online who offer to remove the SIM lock on mobile phones, by emailing the unlock code. All they ask for is the phone's IMEI and the network provider's name.
In one ...
-1
votes
1answer
229 views
How to make QR Code uncopyable - Scanning of the QR Code at consumer level [closed]
I am designing a Consumer Protection System for import products on Blockchain technology. My Client wants to use QR Code instead of Security Tax Stamp. How can we make QR Code uncopyable at the ...
0
votes
0answers
40 views
Forensic software to clone phone physical volume and bypass passcode
I've seen on some forensic blogs dealing with recovering phone data, it will be noted that a phone with a passcode set and usb debugging disabled can still be accessed through specific tools or ...
0
votes
0answers
63 views
How to make screensavers secure?
For years I've been aware of screensaver bugs on some 3rd-party Android ROMs such that the screenlock can reveal the desktop (wallpapers, possibly with some app icons) even if the user doesn't mean to ...
1
vote
1answer
49 views
Should you remove the user's application PIN if they explicitly log out
I am looking for some security driven insight on when to dispose of a mobile application user's PIN in a few scenarios:
Background: When the user downloads and installs the mobile app, they are asked ...
1
vote
0answers
96 views
What kinds of attacks are possible on 3G/4G routers [closed]
How much more or less secure is using a mobile (3G/4G) router to connect to the internet?
I know using tor over the internet should render eavesdropping useless, but excluding physical access, what ...
0
votes
3answers
109 views
Should I block a user from using banking app if they fake the location?
I was wondering if this could be a security issue for banking application and if so, why? What are the risks if I allow it?
1
vote
2answers
61 views
Protecting payment mobile app against mobile theft
Currently I'm designing a payment app.
It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
1
vote
0answers
325 views
What data is bitmoji keyboard collecting about me?
Bitmoji is a virtual keyboard for iOS and Android to create personalized emojis (very paraphrased). I've found a few blogs looking at the permissions it requests and the privacy policy that it shares ...
1
vote
2answers
543 views
Can infection effect a phone through it's wireless hotspot, also the usb tethering
If I made a wireless hotspot from my phone and had computers infected with malware connect and use my wireless connection of the phone can any malware from the pc get into the phone?
If my phone was ...
0
votes
0answers
85 views
All smartphone ports filtered - how to scan smartphones on local Wifi?
I am using Nmap and scanning my smartphone (LG G5 - Android) on my local network and practicing trying to gain remote access into it. However, whenever I scan my cellphone, either all ports are closed ...
3
votes
1answer
65 views
Call and Unsolicited One Time Passwords
Context:
I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
0
votes
0answers
23 views
How is it possible that a webpage can have access to my number if I open the page from my mobile? [duplicate]
While browsing on my mobile, I clicked on an ad and shortly after I received a text saying that I had been subscribed to a service and that to unsubscribe I had to send a text.
This was over a year ...
0
votes
1answer
128 views
Can malware be installed on a mobile phone when the user opens an sms?
Is it possible for an adversary send malware over messages? I mean, when the victim clicks on the message sent by the attacker, a malware should be installed into his phone (in background). The hacker ...
2
votes
1answer
81 views
Identify anonymous mobile phone user by network participants
I have wondered this for quite some time but have not found any references. In the TV series "The wire" they use disposable prepaid mobile phones as a counter-surveillance technique. However if ...
4
votes
0answers
383 views
How secure are IMEI numbers?
I recently had my phone stolen (Galaxy S8) and have done the following:
Wiped it remotely
Reported the theft to network operator, who have allegedly blocked the EMEI
I have tried searching for ...
