Tagged Questions
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.
2
votes
1answer
42 views
+50
Difference/Relationship between data leakage analysis and vulnerability analysis?
What is the difference/relationship between data leakage analysis and vulnerability analysis? How much and what kind of vulnerability testing is required for data leakage analysis?
I have to give ...
1
vote
0answers
7 views
Can usernames & passwords + client certificates exist in Activesync?
Every Activesync writeup I've seen, by MSFT or 3rd parties seems to encourage the deployment of client certificates with the "require" feature, as opposed to the "Accept/Optional" selection.
I want ...
-3
votes
0answers
41 views
What's a good secure Android ROM? [on hold]
I realize this is a nearly impossible request due to Android's deeply embedded high level backdoors hidden within the kernel, but nevertheless I need something that meets the following standards as ...
-4
votes
0answers
89 views
spyware being installed on mobile sim cards [closed]
I had a net ten mobile android zte merit and some one put spyware or malware on my phone. They put it on by only having my phone number I downloaded avast antivirus from Google play and it could not ...
0
votes
1answer
38 views
Is there any secure way to transfer data between mobile phones without Internet? [closed]
Assume that I don't have any Internet access in my country. The only thing that I have is a mobile phone with a 3G or 4G SIM card inside. The mobile operator didn't provide any Internet access also.
...
2
votes
1answer
181 views
SIM card - Cryptography
I would like to have general infos about crypto and commom SIM card in mobile phone(I know there may be different implementations, technos according to the operator...).
Is crypto used only for ...
2
votes
0answers
25 views
Why would my SSO information be cached on my iphone?
I develop a lot of internal applications/websites for my work using our standard SSO. It uses SAML2 and has a few different levels of security available.
We have vendor who is using it for one of ...
1
vote
1answer
71 views
User Authentication for a public website in 2015
I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
1
vote
2answers
60 views
intentionally vulnerable virtualbox or vmware appliances for practicing mobile pentest? [closed]
Is there any virtualbox or vmware appliances or anything like metasploitable that one can use to practice mobile pentest without the real hardware?
I can find those for traditional ethernet but what ...
0
votes
3answers
85 views
Two factor authentication(Mobile)
Consider such two factor authentication on web site: say when user enters username/password on web site - and receives SMS on mobile phone number. For attacker to access this he must know your ...
0
votes
1answer
36 views
MDM: Semi-Complex Password Implications [duplicate]
What would be the security implications if an organisation decided to impliment semi-complex passwords (one letter and one letter), and not fully complex. I'm thinking in terms of mobile devices and ...
0
votes
1answer
31 views
Does Linux and Mac OSX have built-in Credential/Password Managers with API access? [closed]
Does Linux and Mac OSX have built-in Credential/Password Managers with API access like Windows has with its CredMan (CredWrite, etc). It would be preferrable if they could be used without the need to ...
0
votes
1answer
58 views
Default Encryption - A Panacea or Placebo
I wrote this on LinkedIn - Discrete Discretion
My first question is:
Is it accurate to say that default encryption is a placebo? Will default decryption only make end-users think they are secure ...
1
vote
3answers
129 views
How to intercept and analyze mobile SSL application traffic?
What is the best way to analyze requests sent by a mobile application over SSL?
The communication protocol is not necessarily HTTP/S so intercepting them with BURP/ZAP/Fiddler or any other HTTP proxy ...
1
vote
1answer
51 views
What makes an SMS gateway insecure?
Is it specifically something about SMS protocol, the proprietary software used to do message routing, or perhaps an ACL on the server? I would imagine that a gateway accepting emails from anywhere ...
2
votes
1answer
79 views
Methods to defend against rogue (mobile clients)
I'm currently building a MVP (financial mobile app) and trying to understand the best ways to prevent rogue clients interacting with the server.
When looking at the security of most mobile apps I can ...
8
votes
1answer
1k views
If I know a currently working exploit to spoof SMS on a major carrier, what should I do? [closed]
This currently works on all iPhones and one known android phone as of today, a formal complaint has been filed with the carrier and the FCC. I doubt they will do anything about it though since this is ...
-1
votes
1answer
48 views
Are “VPN” and “Certificate Pinning” serving different purpose?
I have a mobile application (ioS) which only certain users are allowed to use, and its coded in such a way that they could only login using secured VPN (with tokens) in order to access our internal ...
3
votes
1answer
82 views
Can sms-only authentication be safe?
many Android mobile applications (e.g., Whatsapp, Telegram), when used for the first time on a device, "authenticate" users by sending them a secret code in a SMS message.
The same mechanism is used ...
6
votes
1answer
48 views
How to determine risk ratings for third party mobile apps
Having rolled out corporate mobile phones and tablets, we have MDM in place enabling us to centrally deploy apps to all our users, and can perform remote wipe in the event of a lost device etc, ...
0
votes
3answers
116 views
Decrypting SSL over a Mobile Network
I work for a large company and we are trying to judge the safety of some proprietary information that is being sent and received in a new application we are developing.
After our initial testing we ...
3
votes
0answers
64 views
REST API stateless authentication using social login
I am implementing a REST API for our mobile applications in which user will login using the SDKs of various social media. Currently, the login strategy is as follows:
The token(s) (access_token in ...
1
vote
1answer
87 views
Is it “cross-platform attack” if first OS is not attacked at all?
I am analyzing a mobile application, which has embedded files(Worms) to attack a desktop OS. But this application does not do any harm to the mobile platform. Mobile is just a medium to deliver ...
1
vote
1answer
44 views
verify an api call is made from the mobile device [duplicate]
I am developing a webserver and provide an API to be used by mobile clients.
Some of my calls are without any authorization, for example, to start the authentication process.
Is there a good way/best ...
-1
votes
1answer
55 views
Can malware “upload” itself to the actual mobile base station and regain back to another phone?
My question is can a malware from my affected phone "upload" itself to the ACTUAL REAL mobile base station from the service provider, and regain back to my another phone with the same number (same ...
2
votes
0answers
57 views
How to securely store application data on mobile device
How can security be enhanced to the maximum in a messaging app storing messaging history on the device (like whatsapp)?
I am specifically referring to methods to minimize the risk of the data being ...
1
vote
0answers
39 views
Are old Android OS's a risk to Activesync email, and how do I block old devices?
I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information.
To mitigate this, ...
0
votes
1answer
33 views
sniff mobile application to find whether packages sent to the third person [closed]
I suspect that my messages via Viber are being sent to another person - because to my mobile have access a lot of people and it could be possible that somebody installed there some software or ...
2
votes
2answers
74 views
Can we verify that an app store ships the same code I have been shown?
When thinking about which messaging solution to use on my new "smart"phone I reflexively tended towards open source products, figuring that I could trust these more to actually provide the security ...
0
votes
1answer
63 views
How to secure Epson Beamer?
I work in a school and we have several Epson Beamers but some of our students have download an application for their mobile (with infra-red and WiFi connection) and they now have remote control and ...
3
votes
2answers
137 views
With Samsung's Knox proven weakness, how should I secure my Samsung device?
This post shows that the device pin is stored in the clear, which presents a major weakness in device security.
Can I just delete the file? Or is there a better way to protect my device?
It appears ...
3
votes
4answers
126 views
Can my phone be affected by malware through mobile phone signal?
My phone is newly bought. Can a hacker actually scan the mobile phone signal around me, detect it, and put virus/malware into my phone THROUGH the mobile phone signal of my mobile service provider?
...
1
vote
2answers
47 views
Mobile apps and apps store security
This question is with regards to mobile apps and apps stores.
Is it possible to program a mobile app that looks like a legitimate app, say for a bank, with the aim that people will download and use ...
2
votes
6answers
117 views
Deterring Mobile phone Tethering in the workplace
How do you put in controls to prevent a staff using his/her mobile phone to tether 3G/4G connection and download unauthorized files onto the office PC? Of course minimally there must be an AV in ...
0
votes
1answer
23 views
Possible for Lync clients to adopt Activesync-style policies?
My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes.
This also made me realize that our other email policies (encrypted device, pin required, ...
0
votes
2answers
84 views
Mobile App Security vs. Traditional PC Desktop Security In The New Era
I have been using a Windows PC for many years now. Since Android has come to market, I have been very wary of installing apps that require unrelated permissions. Obvoiusly, these extra permissions ...
3
votes
2answers
237 views
How Securely Store Sensitive Data on Mobile Appliation
i want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a ...
3
votes
3answers
849 views
Android/iOS application security testing checklist
According to OWASP, we have a list of top ten mobile application vulnerabilities.
But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
0
votes
1answer
53 views
Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
If I'm using something like Authy for soft tokens for my users, and they log into the web application on the mobile device itself, haven't they just lost the benefit of 2FA (ie loss of the mobile ...
1
vote
0answers
41 views
Best way to authenticate for Funding balance with API call [closed]
I have an API call where a user adds to their balance when funds are low. The actual payment is done via Braintree, but I need to allow the user to make that call via their API.
What would be a good ...
1
vote
1answer
117 views
Tracing a text message
Good afternoon,
Is there anyway to trace a text message? As far as the real phone number that the text is being sent from? Or the location of where the text is being sent from?
I've been getting ...
2
votes
1answer
653 views
Can my phone be hacked just by being called?
I recently found a site, Cell-Spy-Stealth.com, that claims to sell spyware which can be targeted on a phone by simply making a call to it: "It will work even if you get the voice mail, or if the ...
-6
votes
1answer
115 views
How to find phone number of any user in a specific area? [closed]
I have learned about IMSI catchers but also read that one can not get the phone number through that IMSI.
Lets suppose I want to collect the phone numbers of all people in a college/ shopping mall/ ...
1
vote
1answer
126 views
TextSecure/WhisperPush instant messaging by Open Whisper Systems: End-to-end encrypted or not?
Open Whisper Systems claims that its TextSecure messaging is end-to-end encrypted, but at the same time there are now some rather serious allegations of how it might be betraying its users.
If I ...
8
votes
2answers
945 views
Cordova/Phonegap: RefreshToken in localstorage
I am (partly) following a tutorial to develop a cordova app, based on angularJS. The author stores the refresh token in local storage, which was said to be very bad practice in one of the comments on ...
16
votes
3answers
2k views
Is my phone carrier monitoring my traffic?
Today I started using a VPN on my phone (nexus 5), and after I switched on mobile data and turned off my WiFi, I received a text message from my carrier offering me roaming packages for Europe (which ...
23
votes
2answers
4k views
Why do I need to hide my phone's IMEI
If it is a secret then why is it visible on the box, invoice and the back of the phone?
If it is not a secret then why does it have to be blurred when it gets posted online?
1
vote
1answer
120 views
Mobile, WebServices and SSL
I just started dipping my feet into security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now, but most of them deal with it taking the ...
-5
votes
2answers
144 views
Android Penetration Testing
I need to do pen test for android mobile application. I have an android mobile and laptop connected to same wi-fi network. I need to intercept/capture the requests/traffic of the mobile in the laptop ...
0
votes
0answers
37 views
Do iOS applications have access to the certificates installed?
As the title says, I'm curious if a generic iOS application can access/retrieve the certificates installed in the device (e.g., via a management profile)
Thanks
