Questions tagged [mobile]
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
1
vote
1answer
73 views
How would someone XSS into a WebView?
There are several articles about XSS vulnerabilities in Android/iOS WebViews. By WebView I mean the 'real' webview not SFSafariViewController or Chrome Custom Tabs.
I understand the main concept of ...
2
votes
0answers
63 views
Is restricting a Google API key for an Android app useless?
According to Google, one can add the SHA-1 certificate fingerprint and the name of the package in the Google Developers Console to restrict the usage of his API key to his Android app, so that ...
0
votes
0answers
37 views
Is it possible to log the touch history on the screen of an Android phone?
I have a Samsung running Android 6.0.1. Is it possible to get logs for when the screen was touched in the last hour or so?
0
votes
0answers
65 views
How to send wifi configuration from server to mobile?
I am testing Mobile Device Management.
Here, the Admin needs to publish WiFi configurations (SSID, Password, Security Type etc.) to the mobile over the air. So what should the approach be of sending ...
0
votes
2answers
72 views
Can wireshark capture the exact payload and end point of API used by my Mobile APP?
I was just wondering if someone having total control over his/her network, is running my mobile app. Also wireshark is capturing all requests made using the network. My app is calling API endpoint ...
-1
votes
2answers
155 views
Confirm a photo was taken by an authorised person
The company I work for hires realtors to go and inspect properties, including taking pictures of. We need to make sure that the realtor is the one taking the picture, and is not sending some else to ...
-1
votes
0answers
84 views
SSL man-in-middle attack
A Pentest team has used the xposed tool to unpin the SSL certification in our app.
Do you think that is a valid test scenario?
They have installed proxy CA certificate in the device for that.
Is ...
0
votes
1answer
72 views
Identifying devices in mobile app using UUID
I have a mobile application, for Android and iOS (both native), that communicates with the backend through a REST API (over HTTPS).
The application allows users to sign in or use the app as a guest, ...
-2
votes
0answers
62 views
How to secure apis so that it can be used by my app and web only
I am creating a platform which is based on REST APIs. My platform has apps and web both.
I don't want to make my APIs public and want that my APIs can be used by my own clients (app and web) only.
I ...
1
vote
0answers
103 views
What unique device fingerprinting information can an iOS 12 or iOS 13 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
0
votes
0answers
39 views
Checking authenticity of a mobile app (digital staff card) [duplicate]
I've been asked to implement a digital card for member's of our organisation, to replace the old plastic ones. Members would install our app on their phone and setup a "card" with their photo on it ...
1
vote
1answer
108 views
Is the developer mode like the opened door for hackers to debug the mobile app?
The very good security recommendation is: the mobile app should check if the developer mode is turned on and it should not start. Both in android and iOS. Do you agree with this sentence? What the ...
0
votes
1answer
22 views
BundleID of an iOS Application installed on iOS 10.2.1
I'm fairly new to iOS Security and was trying to obtain the BundleID of the applications installed on my jailbroken iOS Device (10.2.1).
I tried using both Appster and BundleIDs but both failed to ...
0
votes
1answer
63 views
Preventing an unauthorized mobile application from calling REST back end services [duplicate]
In my scenario, I have an Android mobile application which calls my back end REST services. I want prevent other application to call my back end REST services.
If I use certificate and shared key as ...
0
votes
2answers
86 views
Using device fingerprint to prevent an attacker from calling my login REST service for doing dictionary attacks, is this an effective solution?
As you know, REST services of mobile application are vulnerable from calling by other unauthorized users, some attacks can be done, and we don't have any prevention mechanism for them, such as ...
0
votes
1answer
105 views
Android leaking app analysis
In my thesis I'm trying to analyze leaking private data on Android apps. I noticed that the vast majority of data is encrypted.
How can I analyze this data without decrypting it?
0
votes
0answers
43 views
Logging Keycode event in android secure or insecure?
During the android application security assessment, I have observed the application logging the keycode events at sensitive areas like credit card input field. Is it secure or not?
Please observe the ...
3
votes
0answers
77 views
Bug in pay by phone screen accepts credit card information [duplicate]
I recently noticed some strange behavior in a pay-as you go mobile hotspot service when I was adding money to my account via phone.
I forgot my pin so I guessed. I was wrong. I guessed again, and it ...
0
votes
0answers
70 views
How to prevent fake OAuth consent screens?
I can't find an answer to this simple question about delegated authorisation:
When using a mobile app, how can a user be sure that a consent screen (let's say Google or Facebook) is a real one? The ...
3
votes
1answer
119 views
Why OWASP considers TouchID as insecure?
As could be reviewed in 1 under Am I Vulnerable... section, OWASP page states that
If the mobile app uses a feature like TouchID, it suffers from insecure authentication.
The reasons for this are ...
1
vote
0answers
59 views
Is Mobile ID secure? Certificates on SIM card (Mobile identity management)
In Switzerland Mobile ID is popular. It looks like it's international known as Mobile identity management.
Mobile identity is a development of online authentication and digital
signatures, where ...
4
votes
1answer
83 views
API pentesting for mobile and web. What's the difference?
So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it'...
1
vote
1answer
142 views
Store user credentials vs store refresh token
I am currently designing a native mobile application that require user authentication and authorization to connect to a REST API. Keycloak will be used as IAM tool and tokens will be JWT.
I don't ...
0
votes
0answers
45 views
What are security features of 5G that will wipe out the need to carry multiple plastic cards and replace them with a single, all-in-one mobile wallet?
I am not really clear what are those security features of 5G that enable us as users wipe out the need to carry multiple plastic cards and replace them with a single, all-in-one mobile wallet?
https:/...
1
vote
1answer
189 views
What is more safe: 3g/4g or public wifi?
The scenario is: John is out of home and, using his smartphone, he need to send some messages from Whatsapp, use Facebook's app and do some bank operations.
Since I have read this and this topics, I'...
1
vote
0answers
66 views
What are the security controls to consider to prevent usage of malicious SDK when developing our fintech mobile app? [closed]
We develop a financial application that will allow payment and other important actions, we also use some SDKs to help us with some functions. Including SDK in our app based on what I understand will ...
1
vote
1answer
170 views
Getting called from hidden caller ID, what are the dangers if I answer?
My girlfriend has been getting calls on her iPhone from a hidden caller ID for several days in a row now. She has not answered any of them because we figured it can't be anything good if it's hidden.
...
0
votes
1answer
86 views
Detecting port scanning activity of a mobile app
I highly suspect that one of my iPhone apps is scanning for open ports on the local network, but can't think of a way to detect such activity.
I know that I can monitor http(s) connections by using ...
0
votes
1answer
58 views
Can a self-root certificate spy on me without a vpn or proxy on iOS?
Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?
0
votes
0answers
214 views
What are the dangers of using 3g/4g in smartphones?
Since we should always avoid public networks, is there some sort of attack that intercept my online activity or steal passwords when I'm using 3g/4g? If exists, how I can protect myself from this type ...
0
votes
0answers
115 views
OAuth2 refresh token flow with mobile app
I'm having some issue with an access token not being refreshed in my mobile application. I'm trying to figure out what would be the best approach to fix it.
This is the scenario faced by some mobile ...
0
votes
1answer
98 views
How does using an auth server for mobile app and not storing API keys on client add security?
I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for ...
1
vote
0answers
37 views
Can an attacker spoof content provider, backup manager or wallpaper manager in Android?
We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app.
So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
3
votes
2answers
167 views
Can websites uniquely identify users by the sim card used to access the website?
If I was to use a phone's data connection to access a website, and then pop that sim card into another phone to access the same website, could the website tell that I am the same user?
0
votes
1answer
40 views
What are the different security concerns associated with open ports on mobile vs open ports on servers?
I found out that, because of the non-static IP address of mobile phones, their open ports are supposed to be more susceptible to attacks. However, I haven't found out why exactly that is the case.
Do ...
3
votes
1answer
161 views
Possible Phishing Attempt?
I use an iPhone. Today I got a text from an unknown number starting from +65. The message was "your one-time Wifi password is xxxx and it’s valid for only 10 minutes". Thought it was a scam and ...
2
votes
2answers
79 views
Could always-listening mobile apps secretly spy on conversations?
Various apps and services available on modern smartphones constantly listen with the mic (e.g. Siri or Google Assistant listening for wake word, "Now Playing" feature on Pixel phones). To settle user ...
0
votes
2answers
124 views
Who: phone manufacturers, GSM operators or OS-creators (or whoever) should care that our mobiles do not to connect to rogue GSM towers?
Which one in this chain should be blamed for not taking care of security:
Phone manufacturers, GSM operators, SIM card manufacturers or OS systems (Android, iOS, etc..) to protect our phones from ...
1
vote
1answer
171 views
Do mobile phones automatically connect to spoofed cellular tower antenna?
I was told that an attacker is able to create a fake cellular tower antenna imitator near your mobile phone, and your phone will automatically connect to it, whether that antenna has an encrypted ...
0
votes
1answer
36 views
Disable Office 365 2FA before period of leave without phone?
On enablement of 2FA in Office 365 Admin center, the only offered 2FA methods are
Text message
Call
Notification in Authenticator app
Passcode in Authenticator app
Obviously, all of them require me ...
1
vote
0answers
33 views
Secure API access with mobile apps in restricted environments
In our current project, IT rules prohibit anything that is not PROD to be publicly accessible from the Internet. Access to development and review environments must be severely restricted. That said, ...
0
votes
1answer
122 views
How I can get MAC address of devices using passive wifi?
There is a project at the university, there are a lot of mobile phones where the wifi works in passive mode and is not connected to an access point. Is it possible to get the MAC address of these ...
0
votes
1answer
62 views
Mobile apps that use OAuth2 to offload authentication to a 3rd party: are they misusing OAuth2?
I have been tasked with building a mobile app that requires users to login to a 3rd party service via OAuth2 to obtain some data about them. This mobile app also requires its own backend database ...
1
vote
3answers
233 views
How can I detect spyware on a smartphone
I'm pretty sure there is spyware on my friend's phone deployed there by her ex. She asked me to find a proof and detect it. I usually sniff my network card with Wireshark to detect such spyware and ...
0
votes
0answers
32 views
Enterprise Mobile Application Security Options?
Background: Recently we've joined one of the biggest data-driven company. Till now we do not have any mobile developer/architect within company. Now business wants to develop mobile applications for ...
0
votes
0answers
50 views
How to delete data on a “keypad mobile” securely before selling it?
Nokia, Model: C1-01, Type: RM-607
How to delete data on a "keypad mobile" securely before selling it?
0
votes
0answers
73 views
Does a SIM Card provide the cellular radio with temporary keys?
I understand that a SIM card is essentially a self contained computer, on which an algorithm is run that will receive a RAND from a network operator, and use it compute temporary keys (CK and IK) ...
0
votes
0answers
202 views
Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?
I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
1
vote
0answers
136 views
Fuzzing of Mobile Applications
I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz.
I searched on ...
8
votes
1answer
330 views
Will two smartphones (identical hardware and software) generate the same canvas fingerprint?
When using Canvas Fingerprint (like on this website) to distinguish users, does two smartphones (same model, same OS version, and no browser/plugin customization) will share the same fingerprint?
