Questions tagged [mobile]
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
0
votes
0answers
51 views
Hacker accessing and sending messages that disapear after you read [on hold]
I have a friend who says he is getting messages of threats and information on what he did or said from this person. He has been accused of making calls to people he doesn't know and I also received a ...
0
votes
0answers
86 views
Is it possible to hack a mobile phone to forward calls and texts?
Is it possible to a hack a persons mobile number and do the following:
Forward his outgoing calls to a group of people.
Forward his outgoing text messages to a group of people.
Forward his WhatsApp ...
-1
votes
1answer
82 views
Does the device you are logging into count as one of the factors for MFA when you are using device biometrics? [duplicate]
Yes it does because
I 'have' the physical device
I 'am' the owner of the fingerprint
But no it doesn't because
1=>2 : If you have my device the fingerprint is now something you can get.
Which ...
0
votes
2answers
64 views
JWT or session cookie for API for both web and mobile app?
I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach.
The only two requirement are:
I need to know the users that are ...
0
votes
1answer
63 views
Can smartphone app be hacked by wifi?
We all know that it is possible to spy on other people in the same wifi network, even if it is difficult.
What about apps, like Facebook app for Android? Is it similar to an https website so it is ...
1
vote
0answers
42 views
What are the security implications of using an iPhone purchased in China
I recently bought an iPhone off Craigslist, but It's come to my attention that the phone was purchased by it's original owner in China (The model no is: A1528). Are there any security implications if ...
0
votes
0answers
21 views
OAuth 2 Client Credentials within Mobile App
I am currently developing a mobile app that communicates with an OAuth server. The server I am trying to access provides two grants: Authorisation Code and a device PIN grant (not sure if it's part of ...
-1
votes
1answer
82 views
Surveillance by mobile network provider
I am customer of Vodafone Germany as my mobile network provider. After extension of my RED S mobile contract i realized, that the option "Vodafone Secure Net" is enforced by the company without ...
0
votes
1answer
97 views
Fake bank text message
I recently tried to use my card to buy something on my phone for £29.99. My card was declined so I used a different card and the payment went through.
A couple minutes later I get a message from a ...
504
votes
18answers
104k views
Police forcing me to install Jingwang spyware app, how to minimize impact?
Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it.
Knowing that I may be ...
1
vote
1answer
38 views
Mobile application authentication using UUID
I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is:
When user signs in, device sends username and ...
0
votes
1answer
98 views
Mobile call encryption [duplicate]
Is the signals of a mobile phone-call encrypted between the phone and the mobile-tower or only between the towers? And is it possible for a non-authority individual to eavesdrop on your conversation ...
24
votes
6answers
5k views
Why do apps with phone verification send the user a message, rather than have the user send one to them? [duplicate]
Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
0
votes
2answers
82 views
What tests can be performed on mobile apps to determine if they are secure?
My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
1
vote
1answer
51 views
Authenticate user based on mobile device identifier
I have a hypothetical mobile game where players don't necessarily need to create accounts to play. Their data is keyed off of a device identifier like an advertising identifier (IDFA) or Apple's ...
0
votes
1answer
49 views
Is there a way to secure an API key on iOS?
When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite ...
1
vote
0answers
39 views
How do third party providers remove the SIM lock on a mobile phone?
There are third party providers online who offer to remove the SIM lock on mobile phones, by emailing the unlock code. All they ask for is the phone's IMEI and the network provider's name.
In one ...
-1
votes
1answer
133 views
How to make QR Code uncopyable - Scanning of the QR Code at consumer level [closed]
I am designing a Consumer Protection System for import products on Blockchain technology. My Client wants to use QR Code instead of Security Tax Stamp. How can we make QR Code uncopyable at the ...
0
votes
0answers
34 views
Forensic software to clone phone physical volume and bypass passcode
I've seen on some forensic blogs dealing with recovering phone data, it will be noted that a phone with a passcode set and usb debugging disabled can still be accessed through specific tools or ...
0
votes
0answers
55 views
How to make screensavers secure?
For years I've been aware of screensaver bugs on some 3rd-party Android ROMs such that the screenlock can reveal the desktop (wallpapers, possibly with some app icons) even if the user doesn't mean to ...
0
votes
1answer
34 views
Should you remove the user's application PIN if they explicitly log out
I am looking for some security driven insight on when to dispose of a mobile application user's PIN in a few scenarios:
Background: When the user downloads and installs the mobile app, they are asked ...
1
vote
0answers
76 views
What kinds of attacks are possible on 3G/4G routers [closed]
How much more or less secure is using a mobile (3G/4G) router to connect to the internet?
I know using tor over the internet should render eavesdropping useless, but excluding physical access, what ...
0
votes
3answers
106 views
Should I block a user from using banking app if they fake the location?
I was wondering if this could be a security issue for banking application and if so, why? What are the risks if I allow it?
1
vote
2answers
59 views
Protecting payment mobile app against mobile theft
Currently I'm designing a payment app.
It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
1
vote
0answers
188 views
What data is bitmoji keyboard collecting about me?
Bitmoji is a virtual keyboard for iOS and Android to create personalized emojis (very paraphrased). I've found a few blogs looking at the permissions it requests and the privacy policy that it shares ...
1
vote
2answers
239 views
Can infection effect a phone through it's wireless hotspot, also the usb tethering
If I made a wireless hotspot from my phone and had computers infected with malware connect and use my wireless connection of the phone can any malware from the pc get into the phone?
If my phone was ...
0
votes
0answers
74 views
All smartphone ports filtered - how to scan smartphones on local Wifi?
I am using Nmap and scanning my smartphone (LG G5 - Android) on my local network and practicing trying to gain remote access into it. However, whenever I scan my cellphone, either all ports are closed ...
3
votes
1answer
56 views
Call and Unsolicited One Time Passwords
Context:
I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
0
votes
0answers
22 views
How is it possible that a webpage can have access to my number if I open the page from my mobile? [duplicate]
While browsing on my mobile, I clicked on an ad and shortly after I received a text saying that I had been subscribed to a service and that to unsubscribe I had to send a text.
This was over a year ...
0
votes
1answer
99 views
Can malware be installed on a mobile phone when the user opens an sms?
Is it possible for an adversary send malware over messages? I mean, when the victim clicks on the message sent by the attacker, a malware should be installed into his phone (in background). The hacker ...
2
votes
1answer
74 views
Identify anonymous mobile phone user by network participants
I have wondered this for quite some time but have not found any references. In the TV series "The wire" they use disposable prepaid mobile phones as a counter-surveillance technique. However if ...
3
votes
0answers
211 views
How secure are IMEI numbers?
I recently had my phone stolen (Galaxy S8) and have done the following:
Wiped it remotely
Reported the theft to network operator, who have allegedly blocked the EMEI
I have tried searching for ...
0
votes
2answers
106 views
OTP generation is specific to SIM or Phone number
Are the messages including OTP sent to a mobile phone addressed to the SIM card or the phone number?
If I decide to have a new phone number and the old phone number is allotted to a new customer, the ...
1
vote
1answer
98 views
Is showing the package name(Android)/bundle ID(ios) a security risk?
Suppose I release an app and accidentally publish the package name/bundle ID of the app which is suppose to be shown in development only, in a page. Is there any security concern that arises from this?...
0
votes
1answer
58 views
How does TrueVault's de-identification process work?
I'm thinking of using TrueVault, but I'm not entirely sure about the sequence of events involved in de-identifying data and re-identifying it. More info here. Here is the process, as I understand it, ...
2
votes
0answers
31 views
What is the right end-to-end process for transmitting/computing w/ HIPPA-compliant data?
Not a security expert so please excuse what may be a basic question. I am creating a health app that needs to be HIPPA compliant. I will of course hire a consultant later on, but I need a feel for how ...
4
votes
1answer
68 views
How is this registration setup vulnerable?
I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
61
votes
11answers
21k views
Why don't websites and devices offer fake logins for hackers?
I was thinking about this earlier this morning and was wondering why websites and devices don't offer fake logins for hackers? What I mean by that is that if a hacker finds out some of your details ...
1
vote
1answer
363 views
OAuth2 for mobile apps with confidential backend client (Is PKCE required?)
I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
0
votes
0answers
86 views
Securing mobile app API Using UDID and Argon2
I'm trying to build an iOS app, I have wrote the code and all, and now I am implementing the APIs to communicate with the database.
The app will be using HTTPS and POST Requests to communicate with ...
3
votes
3answers
263 views
Why don't mobile devices let you change the IMEI number for better anonymity?
The vast majority of modern day mobile devices have a fixed IMEI number that's impossible to change, which makes it easy to track people if they use the same device constantly. It's quite easy to swap ...
3
votes
1answer
99 views
Can Signal encrypted voice calls be listened into by other apps?
Signal App (by Open Whisper) provides encrypted voice calls allowing two people to communicate via a data connection with secure encryption (assuming no MiTM attack). Given that Signal App uses the ...
0
votes
0answers
19 views
Protecting API - Using 3rd party? or Application Firewall? [duplicate]
Our company has a mobile app with a lot of traffic and we want to protect its API.
How can we reduce brute force attacks?
Does account lockout is the fastest and proper way to achieve protection?
We ...
1
vote
1answer
85 views
Shoulder surfing prevention or mitigation for unlocking mobile devices
How can shoulder surfing be prevented or mitigated when unlocking mobile devices?
I found other questions about shoulder surfing that focus more on desktop machines, but I believe the issue is much ...
5
votes
1answer
142 views
Do app lockers improve smartphone security?
I recently installed Norton App Lock on my smartphone. It asks for a password pattern every time one tries to open an app. So, theoretically, it protects you in case someone is able to bypass your OS ...
1
vote
0answers
37 views
Restrict Public API To Access From Single App
I have a REST api on a server and an application for android phones that mostly makes calls to that api and presents the info to the user.
Because the application needs to be a quick way to lookup ...
1
vote
1answer
81 views
somewhat complex dev domain https on local network cert problems
I was trying to mirror my setup to prod as much as possible so I only serve my dev site over https. The setup goes like this...
I have a trusted CA on my machine made by devcert
I generated some ...
1
vote
1answer
58 views
Outlook service is storing decrypted password in server memory – how insecure is it?
I am evaluating the possibility of using Outlook mobile client with an on-premise Exchange 2013 server. However it seems that the app sends quite a bit of data to Microsoft's cloud servers. It also ...
4
votes
3answers
208 views
Is it possible to identify mobile phone user with voice recognition
A friend of mine claims that it is possible to identify every anonymous call (prepaid, skype, etc) only using voice recognition. However the scientific literature which I've read so far is ambiguous, ...
1
vote
0answers
62 views
Password reset link was delivered via text not email, how and why? Any insight is appreciated [closed]
I think my smartphone is being hacked into + controlled by a third party, possibly my internet connection as well. Some very odd things have been ongoing for many months. On my phone I hear constant ...
