Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

0
votes
1answer
30 views

Are there any tools that you recommend for mobile app security testing? [on hold]

I’ve had experience with HPFortify, Veracode, and Checkmarx, however, I’m looking for something that will integrate with our CI, is fast enough to keep up with agile practices, and won’t make the CFO ...
3
votes
1answer
58 views

Is there value in slowing down retries on a fingerprint lock?

My phone has a fingerprint lock and it sometimes fails to identify my fingerprint (for example, if it wasn't positioned correctly). If I fail fingerprint identification 5 times in a row, I'm locked ...
1
vote
0answers
35 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
-4
votes
0answers
38 views

How can secure passwords stored in password managers be entered on mobile apps?

People who know the most about computer security suggest using password managers to log into websites. This allows people to have a different secure password for every website they use. Most of these ...
0
votes
1answer
54 views

Does WhatsApp use certificate pinning?

Does WhatsApp use certificate pinning? I found a post by Preatorian Security from February 2014 that points the lack of certificate pinning as a major security problem, and mentions: Update ...
1
vote
0answers
59 views

Why is Telegram much more popular than Signal, which is, according to everything I've read, more secure? [closed]

I'm disregarding apps such as WhatsApp and Viber, because I assume majority of their users aren't particularly concerned about privacy, so it's not surprising they have more users. But how is it ...
206
votes
15answers
9k views

Tracing the location of a mobile IP from an email

I'm a TV scriptwriter - and not hugely tech-savvy, so please bear with me... If the police have an email, sent by a suspect over a 3G or 4G network, could they use the IP address (since they know ...
1
vote
1answer
37 views

Android keystore passwords leaked

We develop Android applications and by mistake following strings were sent within custom Android project folder to several clients: keyAlias keyPassword storePassword The .keystore file itself was ...
5
votes
2answers
92 views

How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?

I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the ...
2
votes
0answers
44 views

Why more Android applications (compared to iOS) use certificate pinning? [closed]

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...
1
vote
1answer
22 views

Why mobile applications share device characteristics with third parties?

It is known that mobile applications can share with third parties many different types of data from information about the device to search terms used in the application. I understand that search ...
0
votes
1answer
78 views

Doesn't this make 2FA irrelevant and possibly dangerous?

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security. I know our bank doesn't allow us to take cell phones in at all, even if they're completely ...
0
votes
0answers
5 views

Mobile Security and Vulnerability Analysis tool [migrated]

What tools should I use to test the security of my iOS application? What are the open source tools available to make vulnerability assessment of an iOS and android application? Any online tool which ...
3
votes
1answer
75 views

Security of cellular-connected devices

The EFF Secure Messaging Scorecard lists a number of apps that meet all of its security criteria. So assuming that end-to-end encryption is accessible for the majority of people in countries in which ...
0
votes
1answer
68 views

Securing Internal Mobile REST API

I am planning to create an internal API for mobile devices for a company. They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
1
vote
0answers
27 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
0
votes
0answers
70 views

For multiple clients it's better symmetric or assymetric encryption?

I'm a newbie in the encryption world so I'm here for asking which is the best solution between Symmetric and Asymmetric encryption. In our use cases, we have multiple clients that must be ...
4
votes
2answers
78 views

Out of band verification using phone; a fallacy?

More and more websites nowadays require new users to verify their 'identity' by requesting the user prove that he/she has access to a device identified by a telephone number (typically a phone). The ...
0
votes
1answer
93 views

Does non-persistent data ever need to be encrypted?

Does non-persistent data ever need to be encrypted? If I had a project with confidential data stored in non-persistent class variables should I be doing anything to protect this data? I am developing ...
0
votes
0answers
30 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
5
votes
1answer
522 views

Can mobile network operators read WhatsApp metadata?

After turning on end-to-end encryption for WhatsApp is it possible for the network operators to read the metadata of the messages being exchanged? I see here (in Transport security) that metadata ...
18
votes
1answer
2k views

How does end to end encryption work with whatsapp web?

Since today I have noticed whatsapp is using end to end encryption. However web.whatsapp.com is also still working. Does whatsapp establish a connection with my phone to keep things secure?
0
votes
2answers
56 views

Best way to keep cell day to day phone calls private - is VOIP better?

This question is about preventing eavesdropping by hackers, thieves, or other smart people collecting information for shady purposes. Is it better to buy a smartphone and install a VOIP service on it ...
1
vote
1answer
54 views

Internet of things is what exactly? [closed]

I have found that the term IOT (internet of things) is pretty vague. I am wondering if a mobile device, a cell phone, is this considered a part of the IOT realm? It is a thing, and its connected to ...
1
vote
4answers
107 views

How sensitive are mobile telephone numbers?

A question that came to my mind. How sensitive are they really? I mean basically all you can do with them is stalking you with hiding caller ID find out which provider gave out the number but not ...
5
votes
1answer
2k views

What is “NAND mirroring”, the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?

According to Ars Technica, Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...
2
votes
1answer
64 views

Is it possible to know imei number of other mobile using any sort of wireless technology?

Are there methods to grab imei numbers of mobiles irrespective of smart or ordinary using Bluetooth or similar wireless technologies. Case : other mobile may not have Bluetooth or possibly switched ...
-2
votes
1answer
65 views

Regarding Mobile Application Penetration Testing

I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices. Why and why not? I have searched ...
1
vote
1answer
57 views

COPE vs. BYOD - as an employee why should I be interested in BYOD? [closed]

I am curios what is the motivation for employees to go with BYOD? As an employee why I should want to allow installation of MDM solution on my smartphone?
0
votes
2answers
259 views

Why does Telegram not use end-to-end encryption? [closed]

Signal and Telegram are both mobile applications that "try" to ensure secure chats. Signal uses end-to-end encryption, Telegram does this as well (in 'secret chats') but it does not use end-to-end ...
58
votes
3answers
5k views

Why aren't IMSI catchers rendered ineffective by standard MITM defenses?

There's been a lot of reporting in the past few years about law enforcement agencies using IMSI catchers (also known as Stingrays after a popular brand of them) to intercept cellular communications. ...
33
votes
4answers
2k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
3
votes
0answers
78 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
2
votes
1answer
42 views

What are the security implications of installing an iPhone configuration profile?

What are the security risks of installing a "configuration profile" on iOS from www.vshare.com? I don't know what a configuration profile is or what it does. They are found in Settings > General > ...
2
votes
1answer
209 views

T-Mobile WWAN IP address is DoD Network Information Center? [closed]

I wrote an app that grabs the IP address of my Wifi as well as the WWAN i.e. the data part of my Tmobile plan. I have an iPhone. Here is what my app prints. I use pretty standard code to obtain the ...
2
votes
2answers
56 views

Apple's OTA update process

When reading the iOS security doc, on page 6, it discusses the OTA update process. The OTA process, includes sending information of current version and device ID to Apple. Inside the OTA response, ...
-2
votes
1answer
81 views

Can someone send popup message to all mobile network users?

Can you detect all users in the same network cellular or mobile network as you? Is it possible to send SMS or broadcast popup message from your mobile phone to other mobile users in your proximity?
1
vote
2answers
68 views

Blackphone - Silentcircle - mobile apps

i have question about blackphone (silent circle). Is there any advantage over other mobile phones if i want to use third party mobile apps? So if I agree with terms of use of some applications, ...
11
votes
3answers
1k views

Why is my phone connection secure without a password when WiFi is not even with a password?

When I talk on the phone or send text messages, I never need to type a userid and password. But when I use WiFi I need to use a password. How is the phone connection secured without a password, and ...
0
votes
2answers
78 views

Is there a way to uniquely identify a mobile device through packet sniffing?

I need to uniquely identify a mobile device using the "ping" packets that it transmits to cellular towers regularly, in an area of interest by installing a packet sniffer at that location? I only need ...
3
votes
4answers
129 views

Is a users mobile number available to a web service?

The reason I am asking this question is that I just noticed 6 lots of £1.25 charges on my mobile phone bill. I called up the phone company and they said that they are charges from a company called ...
-5
votes
1answer
82 views

Mobile number tracking

Is there any way we can track our mobile when it is lost? I have done a google search on the same and found that we have websites which give us the details of where the SIM was purchased & ...
11
votes
1answer
223 views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
2
votes
1answer
57 views

Is it completely safe to store the unencrypted credentials within a variable in the ios device

Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere. Everytime the user goes out ...
1
vote
1answer
95 views

Android app permission warning: how serious?

Installed a snow emergency parking app published by my city. My android phone warned me that it asks for dangerous permissions. Namely action_boot_completed, get_accounts. It seems strange that a ...
-2
votes
1answer
93 views

Possible phone tapping [closed]

Only when one of my contacts calls me (my son) when I pick up there is somebody else on the line, usually with a foreign accent. When I hang up and called my son, he confirms he made the call and ...
3
votes
2answers
143 views

Risks of lending/borrowing a SIM card temporarily?

Suppose someone asks to borrow my SIM card so they can e.g. check if their phone is unlocked. I watch them use the phone to check what they need to check, and afterwards take my SIM card back. Is ...
4
votes
1answer
50 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
53 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
1
vote
0answers
29 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...