Questions tagged [mobile]
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
994
questions
1
vote
1answer
35 views
Standard Protocols or secure mechanism to authenticate users offline
We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
5
votes
1answer
79 views
Certificate Pinning Best Practice or Alternative
I'm looking for the "best practice" to use in Certificate Pinning or an Alternative.
Scenario: I have a native mobile app and I have pinned the certificate so that the app can validate ...
-4
votes
0answers
69 views
What is the best way to get android hack especially by png.jpg format? [closed]
How to be an expert in this field and getting the knowledge that is needed for these stuff so to solve all the problem of hacking as I can
1
vote
1answer
67 views
How do I maintain/check a user session in the backend without having to use tokens?
I'm trying to login a user and, then, retrieve the user information like we do on a regular web app using php session.
I have searched some solutions but I couldn't find any answer for my problem/...
0
votes
0answers
10 views
Are there fewer firmware chips in a mobile device compared with a laptop or a desktop? [migrated]
For a conventional laptop or desktop computer, there appear to be many firmware chips in which malware might hide:
internal drives
network card
graphics card
sound card
embedded controller
BIOS ...
1
vote
4answers
268 views
Is 2FA a false sense of extra security on a mobile phone?
I understand that 2FA increases security if you are using two different devices, for instance a computer and a mobile phone.
I fail to understand how these security measurements help if you are doing ...
1
vote
0answers
86 views
Should I occasionally replace my SIM card for security reasons?
To be able to use mobile data (e.g. 4G/ LTE) and mobile telephony (e.g. VoLTE) services on my smartphone, I need to put a SIM card into my smartphone (I know embedded-SIM/ eSIM exists but let's ignore ...
0
votes
0answers
29 views
Secure Mobile Deeplink login with SAML (Android, iOS)
We want to use deeplink with a schema to login using SAML in our Mobile Apps:
i.e
ourschema://host?code=12345
The problem is that other apps on iOS can read the content of ourschema:// including the ...
2
votes
1answer
73 views
What are the threat models that using a VPN for mobile data can mitigate?
Some VPN providers offer to encrypt mobile data. This goes beyond the typical Wifi hotspot mitigation paradigm.
So what exactly are the benefits of VPN over mobile data? What threat models can this ...
0
votes
1answer
45 views
What are modern protections against mobile application cloning
I recently started thinking about an attacker which would clone a mobile application, and add some code which would do something malicious, e.g. credential theft. This cloned app would communicate ...
0
votes
0answers
44 views
Storing account data on device
I am trying to make an app that allows the user to connect to a service through an API I am also developing. All passwords and account data are securely stored on the server.
However, how should I ...
0
votes
0answers
42 views
Trying to defend against Cell site simulators
I take a phone, insert a SIM Card in it, then connect it to the internet. Then I switch on Wi-Fi Hotspot on it.
Then I connect a second phone to the Hotspot of the first phone, and use this first ...
0
votes
1answer
125 views
Hiding ip address when using coinomi wallet
How do I hide my ip address if I use a wallet as coinomi? Do I have to use Orbot? If yes, what exactly should I do? (I'm using it from an android) I just want to have privacy when I log into the ...
0
votes
1answer
68 views
Secure REST API for mobile and web application usage
I have been reading about authentication and authorization for the past few days and I still have not figured out what would be a reasonable way to deal with this for both mobile and web applications.
...
1
vote
1answer
70 views
What is the risk of using Windows Phone 8.1 now?
My friend uses Microsoft Phone 8.1 mobile for a tax accountancy firm. As it hasn't received security updates for five years I believe that is a significant information security risk. However, the ...
0
votes
0answers
54 views
Using application encryption instead of relying on HTTPS
I use Google Firebase Services. I am thinking about using only https on mobile to send and receive a payload from my server. I will have RSA encryption with a public key on all clients. So when a ...
0
votes
1answer
105 views
Do mobile phones track sim cards?
I am using a Android ulefone, i was wondering if these devices or any device in general logs / keeps some memory of past used sim cards and ways to identify which ones they are etc.
0
votes
0answers
53 views
Using shared email account to sign in to testing devices
A company I work with has a number of mobile devices that are used primarily for testing apps and websites.
I have advised that to improve security it would be best for each device to be assigned to a ...
1
vote
0answers
35 views
Storing cleartext password in iOS keychain
I'm having a webservice which I'm using for my app. The webservice is using cookies when authenticated. I want to give my users the option to login via TouchID for faster login. Therefore I'm storing ...
56
votes
10answers
15k views
Is it really safe to use Signal or Telegram on untrusted phone hardware?
How safe are we when we use phone hardware from untrusted manufacturers and use end-to-end encrypted communication like Signal and Telegram? Are our conversations really safe from keyloggers or ...
1
vote
2answers
361 views
How to spoof IMEI/SIM location?
Once you plug it into a phone and power it on, the IMEI number of the
phone and the SIM's serial number will be transmitted to the nearest
cell tower(s).
source
Is there a way to spoof the location ...
0
votes
0answers
50 views
Integrating 2FA app into main app
We currently have two distinct apps, one for generating a 2FA token and the other one is the main app. Business is now considering to have only one app left and integrating the authenticator app into ...
0
votes
1answer
84 views
'New vintage' Nokias privacy/anonymity
I have read that devices such as the old Nokia 8310 are used because the privacy/anonymity they provide (for instance for drug dealers)
I have tried to find out if the 'new' vanilla Nokias, such as ...
-1
votes
2answers
112 views
Ensure Http request comes from a Android/IoS mobile app to server? [duplicate]
Say I build a mobile app. For the sake of the example, the app is an Android App and let's call it the Client
And this mobile app communicates with a server application. For the sake of this example, ...
3
votes
1answer
168 views
MSTG-PLATFORM-11: Prevent custom third-party keyboards on Android?
The MASVS states in section "V6: Platform Interaction Requirements" MSTG-PLATFORM-11:
Verify that the app prevents usage of custom third-party keyboards whenever sensitive data is entered.
...
-2
votes
3answers
127 views
Calling from mobile phone without using the cellular network
This has been in the news:
https://www.wired.com/story/fcc-fines-wireless-companies-selling-users-location-data/
Is there a way to make calls without using cell towers?
Also in this context: is it ...
2
votes
1answer
94 views
How is SIM blocking enforced?
The only protection features that mobile phones have to keep thieves that stole a target's device from impersonating that subscriber is the PIN/PUK system that's on by default on most SIM cards.
The ...
1
vote
2answers
176 views
Why are IMSI and IMEI still used?
While I understand their function, both IMSI and IMEI makes tracking and surveillance possible by virtue of being persistent idenfitiers for SIM and handset, respectively.
Why aren't these replaced ...
0
votes
2answers
211 views
Can we use CORS policy to restrict API calls from native mobile app?
We can use CORS to restrict API calls to a specific host in a web app. How to do the same for native mobile app?
I want to restrict API calls from my app alone.
Is it possible to do so?
0
votes
2answers
103 views
Safe mobile browsing
What actions can I take to make web browsing on mobile phone (android) as safe as possible? My main concern are sites that would install malware (has happened before on desktop computer). On a ...
82
votes
8answers
12k views
Do advertisers listen as we talk?
A person talks about a certain thing (product or service) with another person and a short time after the talk the person gets the advertising of the discussed thing on the mobile or desktop device.
I ...
3
votes
1answer
140 views
MSTG-ARCH-7: All security controls have a centralized implementation
In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation".
Now I'm struggling a bit by what ...
4
votes
0answers
177 views
Deauthorization Bug in messenger application - How serious is this?
My question refers to a behavior on a production system with more than 100 million chat users.
Some time ago I changed my account password and removed all devices connected to my account.
The next day ...
0
votes
1answer
125 views
Massive operational security hole
Everything is based on phones now. If I have someone's phone I can reset their Salesforce password, access any SAS services etc.
Assume this
Hacker finds someone's phone number
Hacker buys (or works ...
2
votes
1answer
153 views
Is inputting credit card numbers over a mobile phone secure?
I'm in the UK. In order to top up a pay-as-you-go SIM card, I had to first ring the mobile network to associate my bank card with the SIM before asking them to credit £10 to it (future top-ups don't ...
17
votes
3answers
5k views
Is cell phone number based verification secure?
Websites often send a code to a cell phone number for verification. Is this secure? If it is not secure, are there any better alternatives?
0
votes
0answers
27 views
How secure are mobile phone communications? [duplicate]
It's very common to hear about encryption in web browsers and apps, but that's all about the internet. But what about mobile communications that use a SIM card, like ordinary text messages and voice ...
1
vote
2answers
811 views
What encryption did Encrochat use, and how was it broken? [closed]
On 2nd July, the UK's national news outlets broke the story of an "unprecedented" 4-year-long, Europe-wide investigation that, in the UK, resulted in the arrest of 746 criminals, including ...
1
vote
1answer
55 views
Understanding TS 133 501 (5G) Step 2 of EAP-AKA'
I have a question dealing with the EAP-AKA' used in 5G to authenticate clients coming from a 3GPP-Network.
I read the latest specification on ETSI. The problem which I have is based on Step 2 on Page ...
0
votes
0answers
71 views
Does mobile biometric authentication count as Knowledge, Possession, or Inherence authentication
Apple claims in this year's WWDC that Face ID and Touch ID count for both Possession and Inherence identity factors, because they are using Biometrics (Inherence) to access the secure element on your ...
4
votes
1answer
110 views
What Trusted Execution Environment (TEE) solutions exist for mobile devices?
A trusted execution environment (TEE) provides a way for one to deploy tamper-proof programs on a device. The most prominent example of TEEs seem to be Intel SGX for PCs.
What I wonder is, if there ...
1
vote
2answers
188 views
Is it possible to track someone using their mobile number in the UK?
This is something I've wondered for a while - is it theoretically possible to track someone using their phone number in the UK? It's a classic Hollywood trope and I'm wondering just how much truth ...
0
votes
0answers
38 views
Security concern on locally stored authentication token
It is a common method on mobile applications to allow users to bypass authentication process by verifying a locally stored token (previously authenticated) on device.
This is to strike a balance ...
0
votes
0answers
46 views
Dedicated device for online investing and other security measures
I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
1
vote
1answer
53 views
How to verify secure erasure of Android and Apple mobile devices
I'm aware of how to securely sanitise and verify the sanitisation of data from both HDDs and SSDs, but mobile phones complicate this due to being there a lot of proprietary layers standing between the ...
8
votes
5answers
2k views
Is it possible to ensure client data is correct?
I have faced a problem with securing backend API in case when I can't trust a consumer.
I have a mobile app which uses GPS coordinates. After some calculation app sends GPS coordinates to backend ...
2
votes
1answer
83 views
How do ISPs detect whether a phone uses tethering?
I'm trying to figure out how ISPs detect whether a phone uses tethering beyond checking whether the TTL is set to a particular value. Also, do any major ISPs use a form of passive traffic ...
0
votes
2answers
109 views
Could my mobile number have been used without my knowledge?
I've had an unusual experience today. A phone number (not withdrawn number) texted me demanding to know who I was. Their tone was aggressive and I simply told them I don't know their number. When I ...
0
votes
0answers
52 views
Possible data leakage and traceability regarding mobile personal hotspots
The question
Say, one may use a mobile phone's personal hotspot functionality to broadcast a message locally via the ESSID, like "Happy Birthday Lilian" or "Stand with Hong Kong".
Assuming such ...
1
vote
1answer
80 views
Risks of mobile printing
I know printers are a security hole. I am trying to get the best setup to minimize risk.
Here's the risk that I am trying to mitigate : that an attacker remotely access the printer, and use it as a ...
