Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

1
vote
1answer
23 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
0
votes
0answers
36 views

Are there any NFC Smartcards for Smartphones [closed]

What's the best double interface (contact / contact-less NFC) Smartcard for PGP/SSH/SMIME keys (readable with for example Open Keychain, etc.) as a standard sized card to be readable by smartphones ...
2
votes
1answer
70 views

Is it possible for someone else to add a photo to text messages I am sending? [closed]

Is it possible for someone else to intercept a text message I am sending and add a photo to that message? I recently answered a text message I received from a friend and half way through typing out ...
1
vote
1answer
38 views

Tablet antitampering [closed]

We'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e ...
1
vote
1answer
153 views

What happens if an attacker steals my phone's IMEI number?

I have some questions regarding IMEI numbers and data and identity theft. While searching online I have found many conflicting answers regarding this topic and would like some clarification if ...
0
votes
0answers
42 views

Alternative to ECC for mobile security

I asked a question a couple of months back, which led me to ECC. The following question is in continuation: Current Setup: I've two devices A and B which need to interact with each other securely ...
0
votes
0answers
21 views

SSO implementation in a mobile application

We are currently in the process of implementing SSO for one of our enterprise client in our mobile application. To make it more user friendly we were considering the idea of adding a new endpoint to ...
0
votes
1answer
71 views

Is my JWT refresh plan secure?

I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...
3
votes
2answers
85 views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
2
votes
2answers
66 views

Enabling feature to log in as soon as right password is typed (without pressing enter)

My phone has an option for the PIN lock screen to unlock it as soon as the correct number is entered (without pressing enter). So for example if the password is 77912 then you only have to enter 77912 ...
0
votes
2answers
44 views

Can a mobile operator assign traffic to every SIM card in their network?

When using 3G or 4G internet on my phone, is this running over the SIM card or is this similar to WLAN traffic? Can a mobile network provider assign my mobile internet traffic to my phone by either ...
1
vote
1answer
101 views

Difference between Kali Linux and Santoku Linux

I would like to know, before I will install Santoku, what are the differences between Kali Linux and Santoku Linux? I know that Santoku is dedicated to mobile security testing, but Kali has some tools ...
1
vote
0answers
48 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
1
vote
1answer
61 views

Authentication, authorization in native mobile clients (Android)

I am developing native mobile client for store that requires user authentication in order to make purchases available. I have my web store page, authentication is provided by CMS (OpenCart). Now I ...
0
votes
1answer
38 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
3
votes
1answer
92 views

How easy is it for hackers to gain unauthorized access to resources on an Android phone?

I caught a segment of an NBC news story describing how hackers can access messages, phone conversations, location, camera, microphone, and more provided that they can install a malicious app on your ...
1
vote
1answer
65 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
0
votes
1answer
68 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
-1
votes
1answer
105 views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...
-1
votes
1answer
153 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
0
votes
2answers
138 views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
5
votes
2answers
354 views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...
1
vote
0answers
43 views

Possible to use Cellular encryption data to validate Geolocation?

I need offline-verifiable, time stamped, GPS signals or its equivalent. Since cellular protocols include time stamps, encryption keys and other data, perhaps it's possible to re-use this ...
5
votes
1answer
55 views

Can a mobile phone be induced to fall back to 2G comms?

http://techcrunch.com/2015/02/25/gemalto-2/ So, a bunch of SIM card keys were most likely stolen, but Gemalto claims that this would only affect 2G networks. Supposing all that is true, it's still ...
1
vote
3answers
105 views

Prevent MITM between custom phone app and local server

We're building a Wifi enabled device. The device will be installed locally on each client's office and people in the the small office will connect to this Wifi enabled device, They will send/receive ...
3
votes
1answer
64 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
1
vote
2answers
106 views

Sniffer attack on mobile

I have Nokia lumia 625. And a guy hacked it using sniffer. That's how much I know about it. He has access to all my online texts(eg. Whatsapp, messenger etc) . and also to offline carrier text ...
0
votes
2answers
108 views

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
3
votes
4answers
124 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
2
votes
0answers
51 views

I need a secure laptop tethered to a mobile internet connection. [closed]

I invent things. Think energy, IT security algorithms, etc. I'm actively targeted for information breaches by the largest corporations on the planet. All paranoia aside... I'd like a secure ...
2
votes
1answer
37 views

Is this system of authentication secure for a mobile app? What can I do to improve it?

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in ...
2
votes
0answers
48 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, I Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore ...
2
votes
1answer
81 views

Reading encrypted data before sent to remote server

I'm developing a mobile app (Android only for now) to provide a disposable e-mail service to users. Users will be given temporary e-mail addresses so they can receive and read e-mails for a certain ...
2
votes
1answer
308 views

IP address, iphone, Snapchat

My child is being accused of doing some improper things via Snapchat, but he swears that he did not do anything, and he is the type of person who probably would not. The only thing the police are ...
6
votes
2answers
177 views

Are SIM proactive commands secure?

A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). ...
2
votes
2answers
297 views

In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?

I have mobile devices (low power, low bandwidth) need to act as a proxy for certain types of P2P encrypted data, such as voting, bitcoin payment, or other specific-purpose usage, and I want to make ...
0
votes
1answer
80 views

Audio not playing on Android (Kitkat 4.4.2 on LG G Pro 2 D838) via HTTPS [closed]

I am having issues playing an audio file on the chrome browser! This audio file plays on the chrome browser on my mobile LG G Pro-2(D838) running Kitkat 4.4.2 without any issues. But when i uploaded ...
0
votes
1answer
43 views

how does mdm (mobile device management ) work in byod environment to control the camera?

what i want to know is how mdm (mobile device management ) works in byod environment to control the camera from clicking pictures of a printed document?is there a way other than to shut off the ...
6
votes
1answer
486 views

How to protect from caller-id spoofing?

Yesterday, I listened about caller-id spoofing and was left astonished as it's misuse can result in severe consequences for victim. Please tell me how to protect myself from this prank and is there ...
0
votes
1answer
48 views

Can standalone malware survive on current mobile devices? [closed]

Can malware run on mobile devices? I don't see how it would be able to (given that those devices have fine-grained permissions and sandboxing). Unlike on a desktop OS, malware cannot access registry ...
1
vote
1answer
94 views

Is CloudKit or iCloud suitable for storing PII?

iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device. CloudKit is a similar technology that allows (from what I can tell) the partial ...
3
votes
1answer
85 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
38
votes
7answers
4k views

Why do mobile apps have fine-grained permissions while desktop apps don't? [duplicate]

Androids apps use fine-grained permissions for security reasons, iOS apps (afaik) do it as well. Windows 8.1 applications don't have a permission schema like that, all Linux versions which I have ...
3
votes
1answer
41 views

Securing 2 factor data from apps that are co-located on the same device?

Several apps such as GMail, Coinbase, Yahoo and others require the use of the mobile device to gain access to the data within the app. For example Gmail requires TOTP in Google Authenticator ...
0
votes
0answers
39 views

3GPP Generic Bootstrapping Architecture and IoT/M2M

Is the 3GPP GBA actually in use in some concrete IoT/M2M big deployments? Apparently the OneM2M specs TS-0003-Security_Solutions include GBA in the security stack for M2M and IoT: what do you think it ...
0
votes
1answer
91 views

Security tradeoffs while designing a mobile Web Service API

I'm not a security expert but I want to ask about tradeoffs in a web service API I'm designing for mobile apps. It is an API which tracks users' locations so yes, the data is reasonably sensitive. ...
4
votes
2answers
146 views

Difference/Relationship between data leakage analysis and vulnerability analysis?

What is the difference/relationship between data leakage analysis and vulnerability analysis? How much and what kind of vulnerability testing is required for data leakage analysis? I have to give ...
1
vote
0answers
51 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password ...
0
votes
1answer
83 views

Is there any secure way to transfer data between mobile phones without Internet? [closed]

Assume that I don't have any Internet access in my country. The only thing that I have is a mobile phone with a 3G or 4G SIM card inside. The mobile operator didn't provide any Internet access also. ...
3
votes
1answer
366 views

SIM card - Cryptography

I would like to have general infos about crypto and commom SIM card in mobile phone(I know there may be different implementations, technos according to the operator...). Is crypto used only for ...