Questions tagged [mobile]
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
0
votes
0answers
49 views
How to prevent fake OAuth consent screens?
I can't find an answer to this simple question about delegated authorisation:
When using a mobile app, how can a user be sure that a consent screen (let's say Google or Facebook) is a real one? The ...
3
votes
1answer
84 views
Why OWASP considers TouchID as insecure?
As could be reviewed in 1 under Am I Vulnerable... section, OWASP page states that
If the mobile app uses a feature like TouchID, it suffers from insecure authentication.
The reasons for this are ...
1
vote
0answers
36 views
Is Mobile ID secure? Certificates on SIM card (Mobile identity management)
In Switzerland Mobile ID is popular. It looks like it's international known as Mobile identity management.
Mobile identity is a development of online authentication and digital
signatures, where ...
4
votes
1answer
65 views
API pentesting for mobile and web. What's the difference?
So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it'...
0
votes
0answers
37 views
How does cellular data differ from an ISP, and what can be tracked? [migrated]
Are IP addresses given to a phone static or not?
Also, how can phone companies keep track of a person if they wanted to find them? For example, I don't have an account and use a pre-paid card.
I'm ...
1
vote
1answer
59 views
Store user credentials vs store refresh token
I am currently designing a native mobile application that require user authentication and authorization to connect to a REST API. Keycloak will be used as IAM tool and tokens will be JWT.
I don't ...
0
votes
0answers
40 views
What are security features of 5G that will wipe out the need to carry multiple plastic cards and replace them with a single, all-in-one mobile wallet?
I am not really clear what are those security features of 5G that enable us as users wipe out the need to carry multiple plastic cards and replace them with a single, all-in-one mobile wallet?
https:/...
1
vote
1answer
154 views
What is more safe: 3g/4g or public wifi?
The scenario is: John is out of home and, using his smartphone, he need to send some messages from Whatsapp, use Facebook's app and do some bank operations.
Since I have read this and this topics, I'...
1
vote
0answers
62 views
What are the security controls to consider to prevent usage of malicious SDK when developing our fintech mobile app? [closed]
We develop a financial application that will allow payment and other important actions, we also use some SDKs to help us with some functions. Including SDK in our app based on what I understand will ...
1
vote
1answer
154 views
Getting called from hidden caller ID, what are the dangers if I answer?
My girlfriend has been getting calls on her iPhone from a hidden caller ID for several days in a row now. She has not answered any of them because we figured it can't be anything good if it's hidden.
...
0
votes
1answer
81 views
Detecting port scanning activity of a mobile app
I highly suspect that one of my iPhone apps is scanning for open ports on the local network, but can't think of a way to detect such activity.
I know that I can monitor http(s) connections by using ...
-1
votes
0answers
52 views
how does Google login differentiate between it's own apps and third party apps?
When you're using one of the Google apps, you enter your credentials and the app can now access all the relevant Google APIs..
When you're using a third party app and using "Login with Google", ...
0
votes
1answer
49 views
Can a self-root certificate spy on me without a vpn or proxy on iOS?
Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?
0
votes
0answers
126 views
What are the dangers of using 3g/4g in smartphones?
Since we should always avoid public networks, is there some sort of attack that intercept my online activity or steal passwords when I'm using 3g/4g? If exists, how I can protect myself from this type ...
0
votes
0answers
46 views
OAuth2 refresh token flow with mobile app
I'm having some issue with an access token not being refreshed in my mobile application. I'm trying to figure out what would be the best approach to fix it.
This is the scenario faced by some mobile ...
0
votes
1answer
53 views
How does using an auth server for mobile app and not storing API keys on client add security?
I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for ...
1
vote
0answers
31 views
Can an attacker spoof content provider, backup manager or wallpaper manager in Android?
We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app.
So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
3
votes
2answers
138 views
Can websites uniquely identify users by the sim card used to access the website?
If I was to use a phone's data connection to access a website, and then pop that sim card into another phone to access the same website, could the website tell that I am the same user?
0
votes
1answer
36 views
What are the different security concerns associated with open ports on mobile vs open ports on servers?
I found out that, because of the non-static IP address of mobile phones, their open ports are supposed to be more susceptible to attacks. However, I haven't found out why exactly that is the case.
Do ...
3
votes
1answer
145 views
Possible Phishing Attempt?
I use an iPhone. Today I got a text from an unknown number starting from +65. The message was "your one-time Wifi password is xxxx and it’s valid for only 10 minutes". Thought it was a scam and ...
2
votes
2answers
71 views
Could always-listening mobile apps secretly spy on conversations?
Various apps and services available on modern smartphones constantly listen with the mic (e.g. Siri or Google Assistant listening for wake word, "Now Playing" feature on Pixel phones). To settle user ...
0
votes
2answers
114 views
Who: phone manufacturers, GSM operators or OS-creators (or whoever) should care that our mobiles do not to connect to rogue GSM towers?
Which one in this chain should be blamed for not taking care of security:
Phone manufacturers, GSM operators, SIM card manufacturers or OS systems (Android, iOS, etc..) to protect our phones from ...
1
vote
1answer
138 views
Do mobile phones automatically connect to spoofed cellular tower antenna?
I was told that an attacker is able to create a fake cellular tower antenna imitator near your mobile phone, and your phone will automatically connect to it, whether that antenna has an encrypted ...
0
votes
1answer
34 views
Disable Office 365 2FA before period of leave without phone?
On enablement of 2FA in Office 365 Admin center, the only offered 2FA methods are
Text message
Call
Notification in Authenticator app
Passcode in Authenticator app
Obviously, all of them require me ...
1
vote
0answers
22 views
Secure API access with mobile apps in restricted environments
In our current project, IT rules prohibit anything that is not PROD to be publicly accessible from the Internet. Access to development and review environments must be severely restricted. That said, ...
0
votes
1answer
77 views
How I can get MAC address of devices using passive wifi?
There is a project at the university, there are a lot of mobile phones where the wifi works in passive mode and is not connected to an access point. Is it possible to get the MAC address of these ...
0
votes
1answer
49 views
Mobile apps that use OAuth2 to offload authentication to a 3rd party: are they misusing OAuth2?
I have been tasked with building a mobile app that requires users to login to a 3rd party service via OAuth2 to obtain some data about them. This mobile app also requires its own backend database ...
1
vote
3answers
164 views
How can I detect spyware on a smartphone
I'm pretty sure there is spyware on my friend's phone deployed there by her ex. She asked me to find a proof and detect it. I usually sniff my network card with Wireshark to detect such spyware and ...
0
votes
0answers
27 views
Enterprise Mobile Application Security Options?
Background: Recently we've joined one of the biggest data-driven company. Till now we do not have any mobile developer/architect within company. Now business wants to develop mobile applications for ...
0
votes
0answers
46 views
How to delete data on a “keypad mobile” securely before selling it?
Nokia, Model: C1-01, Type: RM-607
How to delete data on a "keypad mobile" securely before selling it?
0
votes
0answers
55 views
Does a SIM Card provide the cellular radio with temporary keys?
I understand that a SIM card is essentially a self contained computer, on which an algorithm is run that will receive a RAND from a network operator, and use it compute temporary keys (CK and IK) ...
0
votes
0answers
106 views
Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?
I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
1
vote
0answers
95 views
Fuzzing of Mobile Applications
I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz.
I searched on ...
8
votes
1answer
290 views
Will two smartphones (identical hardware and software) generate the same canvas fingerprint?
When using Canvas Fingerprint (like on this website) to distinguish users, does two smartphones (same model, same OS version, and no browser/plugin customization) will share the same fingerprint?
0
votes
1answer
42 views
How do JavaScript (and mobile) APIs keep user data clean?
Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
0
votes
1answer
32 views
Revoke OAuth2 Token For Mobile App
When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an ...
3
votes
3answers
220 views
A protocol for encrypting the data on the server, but with a password on a mobile device
I want to implement the following encryption scheme. The data is created and stored on a web server, but related to some user of the system (i.e. it is entered "on behalf" of the user). Both ...
1
vote
0answers
181 views
Android WebView JavaScript Enabled
I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
0
votes
1answer
31 views
Basic Auth Credentials on Mobile Device
I am testing a mobile app that makes requests to a web service. Web service has two sets of functions. Class A functions can be called before login and Class B functions can be called after login. ...
2
votes
0answers
66 views
Can (the carrier of) a caller/callee see the position of the other ones mobile phone?
Someone came to me with the following request:
He/She wants to drive somewhere without the employer knowing in his/her free time. If the employer will know about the drive, it will be bad for his/her ...
4
votes
2answers
213 views
Upload malware to F-Droid repo?
What's the auditing/vetting process like to get an Android app into the F-Droid repository? To ask it another way, what's to stop an evil developer from uploading a backdoored Android app to the F-...
2
votes
2answers
96 views
How to protect API endpoint from abuse in mobile App?
Let's assume I have a mobile app that fetches the news feed from an url on my server.
GET/ https://example.com/api/v1/newsfeed
Is there a way to restrict the access to this endpoint to only from ...
1
vote
2answers
199 views
Prevent Text Spoofing - Best methods
In an enterprise environment we have been inundated with spoof texts appearing to be from the corporate office.
After much research it appears Verizon isn't able to assist. Just wondering if anyone ...
3
votes
0answers
150 views
What is the most secure NFC Encryption system? [closed]
What are the best ways for NFC (Near-field communication) encryption with high level of security?
Basically, I am interested in having an NFC which can only be read/authenticated with a mobile app/...
2
votes
0answers
52 views
Risk that apps with access to your saved files and camera roll get a hold of all your saved files and photos [closed]
Since I made pictures of some documents that should never be released to the public I was wondering how high the risks actually are, that the pictures I made have been "saved" by some of my apps, or ...
8
votes
3answers
259 views
Is a second, “old” (dumb) phone dedicated just to receiving bank tokens as safe as “modern” (smart) phone?
Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens?
Is SMS encrypted?
1
vote
3answers
215 views
How to prevent unauthorized users from accessing an image on my server just by URL?
I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
2
votes
0answers
40 views
How to give end users access to accounts previously only administered by managers?
I have a question about how to handle a somewhat unique authentication situation.
We have an existing system with lots of users that have never had direct access to their accounts before. They have ...
0
votes
1answer
351 views
4G Pocket WiFi - IMSI Catcher?
Nearly all mobile phones are vulnerable to IMSI catcher attack's fake mobile networks. They can access storage, inject rootkits/backdoors, turn the microphone on view internet traffic even with a VPN ...
4
votes
1answer
133 views
GSM - Implementing Cipher Mode Command on YateBTS
I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!?
I use the combination of BladeRF x40 FPGA and ...
