Questions tagged [mobile]
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
0
votes
0answers
25 views
Work WiFi - privacy [duplicate]
If I browse using my mobile data on and then I go into work and my iPhone automatically connects to their WiFi, can they see my previous history or only stuff I’ve accessed while on the internet ...
1
vote
2answers
52 views
How to protect API endpoint from abuse in mobile App?
Let's assume I have a mobile app that fetches the news feed from an url on my server.
GET/ https://example.com/api/v1/newsfeed
Is there a way to restrict the access to this endpoint to only from ...
1
vote
2answers
81 views
Prevent Text Spoofing - Best methods
In an enterprise environment we have been inundated with spoof texts appearing to be from the corporate office.
After much research it appears Verizon isn't able to assist. Just wondering if anyone ...
3
votes
0answers
49 views
What is the most secure NFC Encryption system? [closed]
What are the best ways for NFC (Near-field communication) encryption with high level of security?
Basically, I am interested in having an NFC which can only be read/authenticated with a mobile app/...
2
votes
0answers
44 views
Risk that apps with access to your saved files and camera roll get a hold of all your saved files and photos
Since I made pictures of some documents that should never be released to the public I was wondering how high the risks actually are, that the pictures I made have been "saved" by some of my apps, or ...
8
votes
3answers
201 views
Is a second, “old” (dumb) phone dedicated just to receiving bank tokens as safe as “modern” (smart) phone?
Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens?
Is SMS encrypted?
1
vote
3answers
167 views
How to prevent unauthorized users from accessing an image on my server just by URL?
I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
2
votes
0answers
39 views
How to give end users access to accounts previously only administered by managers?
I have a question about how to handle a somewhat unique authentication situation.
We have an existing system with lots of users that have never had direct access to their accounts before. They have ...
-1
votes
0answers
30 views
Is messaging using a mobile jabber client and the jabber network secure?
Given that WhatsApp does not advertise itself as secure, and that the EFF foundation is not giving any recomendations on open source messaging apps while providing a guide to install Signal and ...
0
votes
1answer
87 views
4G Pocket WiFi - IMSI Catcher?
Nearly all mobile phones are vulnerable to IMSI catcher attack's fake mobile networks. They can access storage, inject rootkits/backdoors, turn the microphone on view internet traffic even with a VPN ...
3
votes
1answer
61 views
GSM - Implementing Cipher Mode Command on YateBTS
I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!?
I use the combination of BladeRF x40 FPGA and ...
0
votes
1answer
90 views
Does the device you are logging into count as one of the factors for MFA when you are using device biometrics? [duplicate]
Yes it does because
I 'have' the physical device
I 'am' the owner of the fingerprint
But no it doesn't because
1=>2 : If you have my device the fingerprint is now something you can get.
Which ...
0
votes
2answers
204 views
JWT or session cookie for API for both web and mobile app?
I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach.
The only two requirement are:
I need to know the users that are ...
0
votes
1answer
89 views
Can smartphone app be hacked by wifi?
We all know that it is possible to spy on other people in the same wifi network, even if it is difficult.
What about apps, like Facebook app for Android? Is it similar to an https website so it is ...
1
vote
0answers
45 views
What are the security implications of using an iPhone purchased in China
I recently bought an iPhone off Craigslist, but It's come to my attention that the phone was purchased by it's original owner in China (The model no is: A1528). Are there any security implications if ...
0
votes
0answers
35 views
OAuth 2 Client Credentials within Mobile App
I am currently developing a mobile app that communicates with an OAuth server. The server I am trying to access provides two grants: Authorisation Code and a device PIN grant (not sure if it's part of ...
-1
votes
1answer
99 views
Surveillance by mobile network provider
I am customer of Vodafone Germany as my mobile network provider. After extension of my RED S mobile contract i realized, that the option "Vodafone Secure Net" is enforced by the company without ...
0
votes
1answer
106 views
Fake bank text message
I recently tried to use my card to buy something on my phone for £29.99. My card was declined so I used a different card and the payment went through.
A couple minutes later I get a message from a ...
508
votes
18answers
106k views
Police forcing me to install Jingwang spyware app, how to minimize impact?
Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it.
Knowing that I may be ...
1
vote
1answer
48 views
Mobile application authentication using UUID
I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is:
When user signs in, device sends username and ...
0
votes
1answer
147 views
Mobile call encryption [duplicate]
Is the signals of a mobile phone-call encrypted between the phone and the mobile-tower or only between the towers? And is it possible for a non-authority individual to eavesdrop on your conversation ...
24
votes
6answers
5k views
Why do apps with phone verification send the user a message, rather than have the user send one to them? [duplicate]
Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
0
votes
2answers
90 views
What tests can be performed on mobile apps to determine if they are secure?
My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
3
votes
2answers
108 views
Authenticate user based on mobile device identifier
I have a hypothetical mobile game where players don't necessarily need to create accounts to play. Their data is keyed off of a device identifier like an advertising identifier (IDFA) or Apple's ...
0
votes
1answer
86 views
Is there a way to secure an API key on iOS?
When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite ...
1
vote
0answers
59 views
How do third party providers remove the SIM lock on a mobile phone?
There are third party providers online who offer to remove the SIM lock on mobile phones, by emailing the unlock code. All they ask for is the phone's IMEI and the network provider's name.
In one ...
-1
votes
1answer
179 views
How to make QR Code uncopyable - Scanning of the QR Code at consumer level [closed]
I am designing a Consumer Protection System for import products on Blockchain technology. My Client wants to use QR Code instead of Security Tax Stamp. How can we make QR Code uncopyable at the ...
0
votes
0answers
38 views
Forensic software to clone phone physical volume and bypass passcode
I've seen on some forensic blogs dealing with recovering phone data, it will be noted that a phone with a passcode set and usb debugging disabled can still be accessed through specific tools or ...
0
votes
0answers
62 views
How to make screensavers secure?
For years I've been aware of screensaver bugs on some 3rd-party Android ROMs such that the screenlock can reveal the desktop (wallpapers, possibly with some app icons) even if the user doesn't mean to ...
1
vote
1answer
49 views
Should you remove the user's application PIN if they explicitly log out
I am looking for some security driven insight on when to dispose of a mobile application user's PIN in a few scenarios:
Background: When the user downloads and installs the mobile app, they are asked ...
1
vote
0answers
89 views
What kinds of attacks are possible on 3G/4G routers [closed]
How much more or less secure is using a mobile (3G/4G) router to connect to the internet?
I know using tor over the internet should render eavesdropping useless, but excluding physical access, what ...
0
votes
3answers
108 views
Should I block a user from using banking app if they fake the location?
I was wondering if this could be a security issue for banking application and if so, why? What are the risks if I allow it?
1
vote
2answers
61 views
Protecting payment mobile app against mobile theft
Currently I'm designing a payment app.
It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
1
vote
0answers
261 views
What data is bitmoji keyboard collecting about me?
Bitmoji is a virtual keyboard for iOS and Android to create personalized emojis (very paraphrased). I've found a few blogs looking at the permissions it requests and the privacy policy that it shares ...
1
vote
2answers
424 views
Can infection effect a phone through it's wireless hotspot, also the usb tethering
If I made a wireless hotspot from my phone and had computers infected with malware connect and use my wireless connection of the phone can any malware from the pc get into the phone?
If my phone was ...
0
votes
0answers
80 views
All smartphone ports filtered - how to scan smartphones on local Wifi?
I am using Nmap and scanning my smartphone (LG G5 - Android) on my local network and practicing trying to gain remote access into it. However, whenever I scan my cellphone, either all ports are closed ...
3
votes
1answer
60 views
Call and Unsolicited One Time Passwords
Context:
I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
0
votes
0answers
22 views
How is it possible that a webpage can have access to my number if I open the page from my mobile? [duplicate]
While browsing on my mobile, I clicked on an ad and shortly after I received a text saying that I had been subscribed to a service and that to unsubscribe I had to send a text.
This was over a year ...
0
votes
1answer
105 views
Can malware be installed on a mobile phone when the user opens an sms?
Is it possible for an adversary send malware over messages? I mean, when the victim clicks on the message sent by the attacker, a malware should be installed into his phone (in background). The hacker ...
2
votes
1answer
80 views
Identify anonymous mobile phone user by network participants
I have wondered this for quite some time but have not found any references. In the TV series "The wire" they use disposable prepaid mobile phones as a counter-surveillance technique. However if ...
3
votes
0answers
281 views
How secure are IMEI numbers?
I recently had my phone stolen (Galaxy S8) and have done the following:
Wiped it remotely
Reported the theft to network operator, who have allegedly blocked the EMEI
I have tried searching for ...
0
votes
2answers
186 views
OTP generation is specific to SIM or Phone number
Are the messages including OTP sent to a mobile phone addressed to the SIM card or the phone number?
If I decide to have a new phone number and the old phone number is allotted to a new customer, the ...
1
vote
1answer
115 views
Is showing the package name(Android)/bundle ID(ios) a security risk?
Suppose I release an app and accidentally publish the package name/bundle ID of the app which is suppose to be shown in development only, in a page. Is there any security concern that arises from this?...
0
votes
1answer
59 views
How does TrueVault's de-identification process work?
I'm thinking of using TrueVault, but I'm not entirely sure about the sequence of events involved in de-identifying data and re-identifying it. More info here. Here is the process, as I understand it, ...
2
votes
0answers
34 views
What is the right end-to-end process for transmitting/computing w/ HIPPA-compliant data?
Not a security expert so please excuse what may be a basic question. I am creating a health app that needs to be HIPPA compliant. I will of course hire a consultant later on, but I need a feel for how ...
4
votes
1answer
70 views
How is this registration setup vulnerable?
I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
62
votes
11answers
22k views
Why don't websites and devices offer fake logins for hackers?
I was thinking about this earlier this morning and was wondering why websites and devices don't offer fake logins for hackers? What I mean by that is that if a hacker finds out some of your details ...
1
vote
1answer
479 views
OAuth2 for mobile apps with confidential backend client (Is PKCE required?)
I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
0
votes
0answers
102 views
Securing mobile app API Using UDID and Argon2
I'm trying to build an iOS app, I have wrote the code and all, and now I am implementing the APIs to communicate with the database.
The app will be using HTTPS and POST Requests to communicate with ...
3
votes
3answers
353 views
Why don't mobile devices let you change the IMEI number for better anonymity?
The vast majority of modern day mobile devices have a fixed IMEI number that's impossible to change, which makes it easy to track people if they use the same device constantly. It's quite easy to swap ...
