Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [mobile]

Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

Can anyone explain IPv6 geographic locations, as assigned by Verizon? [closed]

I have a co-worker (non-technical workplace), who claims he's being hacked because some of the time his IPv6 locations are in other parts of the country, or in adjacent cities (large metro area). I'm ...
user avatar
0 votes
1 answer
42 views

Mobile Application Security

Do we need to carry out separate pentest for apps that are written in language that supports multi platform compilation like fultter? How much value it will bring since backend and major chunk of code ...
user avatar
-1 votes
0 answers
13 views

Limiting Mobile Fingerprints For Google?

I run a small agency managing numerous Google accounts and am trying to determine the best route for managing/hiding fingerprints on mobile from Google, outside of good dedicated proxies (which I ...
user avatar
1 vote
0 answers
16 views

SIM hardware protection of master and long lived keys

4G and 5G authentication procedures includes master keys or long term keys which are shared between subscribers and Home Networks, for 4G they are called Ki. A case was reported here in which NSA ...
user avatar
1 vote
0 answers
79 views

How does end-to-end encryption work with whatsapp web as of 2022?

The accepted answer to this question is now outdated, since Whatsapp web does not require an online smartphone to function anymore. How is the key exchange performed securely?
user avatar
0 votes
0 answers
21 views

What is the 'domain name' in PKCE Auth flow for mobile apps?

I'm interested in building a mobile app that authenticates with a service using OAuth2 so that my app can use their API's. Documentation To apply for an application key, I need to enter my application'...
user avatar
0 votes
0 answers
31 views

can an attacker intercept phone call if he has access to my sim?

I read here and here that an attacker, that has physical access to my SIM, card could be able to extract the encryption key from my sim and then intercept and decrypt phone calls. This can be true ?...
user avatar
0 votes
0 answers
54 views

Allow the use of camera phones in the manufacturing facilities; but then how do I maintain the security of the premises

What are the best practices to be followed to maintain security in the manufacturing site where camera phones are allowed? I'm working on one of the largest manufacturing facility where few of the R&...
user avatar
0 votes
1 answer
90 views

3rd party mobile app access our service via our APIs

We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service. We have a customer(a company), ...
user avatar
2 votes
2 answers
361 views

Understanding Certificate Transparency in Mobile apps and How it Affects Traffic Proxying

I am familiar with the basics of CT and certificate pinning. However, I'm failing to understand how CT properly replaces pinning in mobile apps in a scenario in which, for example, an attacker steals ...
user avatar
0 votes
0 answers
48 views

Is using a second hand/grey market phone for banking security a credible risk?

I asked this question in money about telling my bank about using a second hand or grey market mobile phone. The the implication of some of the comments is that any worry is misplaced. It seems to me ...
user avatar
  • 101
0 votes
0 answers
26 views

What are the pitfalls of adding a corporate eSIM to an unmanaged employee device in lieu of land-line phones?

Instead of having a landline at each employee's desk, allow them to add an eSIM to a compatible personal cell phone. (If possible, disable SMS for the added eSIM so it is acting as a replacement for ...
user avatar
0 votes
0 answers
22 views

Does the action of private APIs of iOS need user's manual authentication?

Some iOS apps from my company need to be installed to my iPhone, which are "untrusted enterprise certificate" apps, not from the "app store". Considering the possible usage of ...
user avatar
  • 131
1 vote
0 answers
70 views

Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]

I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password. The ...
user avatar
0 votes
2 answers
141 views

Malicious SMS and iMessage Interception

I have an interesting situation on my hands. There are people in my neighborhood that have been harassing me for some time now. It appears that these individuals can are receiving my text (sms) ...
user avatar
0 votes
0 answers
69 views

What are the risks of an unauthorised device connected to a mobile hotspot?

My friend had to activate a mobile hotspot on his iphone for half an hour in an airport to connect his laptop, and suddenly he realized that his device was not the only one connected to it. What are ...
user avatar
  • 39
3 votes
0 answers
96 views

Security of in-app Forgot Password workflow in Xamarin (Mobile App) without using a website

I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I've seen for any app is: User requests password reset ...
user avatar
  • 131
0 votes
0 answers
313 views

Decrypt mobile phone app TLS/SSL traffic using Wireshark and Fiddler/Charles/MITM Proxy

I currently use fiddler/Charles Proxy/MITM proxy to decrypt and analyze SSL/TLS traffic from suspect mobile apps I want to analyze. The process I follow is to export a CA cert from Fiddler, then ...
user avatar
  • 1
1 vote
1 answer
113 views

Is it possible to recover data from a bricked smartphone?

I have a smartphone that got bricked last year without warning, and it was deemed unrepairable by multiple repair centers. I did have personal stuff on it. If I recycle this phone, can someone down ...
user avatar
0 votes
1 answer
78 views

Block API calls from app to stop DDoS attacks

Recently we had a discussion about the security of a mobile app we are working on. The security team requested that if a user is blocked (due to many failed login attempts), then the back-end should ...
user avatar
  • 1
0 votes
0 answers
31 views

Is it possible to be infected without installing anything like said at the beginning of the video? [duplicate]

It seems like a 'crazy' claim that John McAfee makes at the very beginning of this video, is it true? "Over half of all smartphones, both iOS and Android are infected with keystroke logging ...
user avatar
0 votes
0 answers
100 views

How to check if a speaker can be used as microphone and how to neuter it?

This post: Can a speaker be used as a microphone? mentions that speakers can be used as microphone too it depends on the software and the speaker. For a modern smartphone, tablet or notebook, is it ...
user avatar
1 vote
0 answers
141 views

How can I know if phone is already infected?

Last year, my friend who is learning hacking for nearly 3 years hacked my phone using social engineering by installing some malware in my phone. (After researching on Google, I think it might be a ...
user avatar
0 votes
1 answer
143 views

What's the threat model of mobile security? [closed]

When reading about mobile security, the attacker is often assumed to have root access to the device, so as to patch the application or proxy all network traffic. I see that such applications may have ...
user avatar
  • 1,097
1 vote
1 answer
153 views

Do Spier or similar products really hack the phones remotely?

Spier makes lots of claims; How to Hack Someone’s Phone Remotely How to Hack Someone’s Phone Without Touching It We have Signaling System No. 7 (SS7) flaw that can be used to monitor activities, ...
user avatar
  • 5,469
0 votes
1 answer
106 views

When GPS is spoofed in a smartphone, does this affect whatever is being monitored?

When GPS is spoofed in a smartphone, does this affect whatever is being monitored? Suppose I spoof the GPS on my smartphone, such as lazy Pokemon GO players do to play from their couch. Will this ...
user avatar
0 votes
3 answers
260 views

What to do after opening a potentially malicious link on smartphone?

What must one do if they opened a malicious link? Warning: Please do not open the links below as they may be malicious. They have been deliberately mangled to prevent accidental opening I received an ...
user avatar
  • 1
1 vote
0 answers
110 views

iOS: What are potential privacy issues with Intune device enrollment?

I work at a large corporation and don't know how the mobile device management (MDM) is configured (and also the settings can be changed dynamically). I have a personal iPhone and the employer wants me ...
user avatar
  • 1,413
0 votes
0 answers
73 views

Escrow Key required after restart (Macbook Air M1) (MDM)

I have Macbook Airs (M1; Big Sur) that even though they successfully enable FDE to a local user, after restart, the device requires the escrow key. The Airbooks are managed by an MDM which pushes the ...
user avatar
1 vote
2 answers
181 views

Scanning for malicious hardware on display replacement for a smartphone

I recently bought a replacement display for my smartphone on ebay from a national supplier. I later realized that it does not have the Huawei logo printed on it, but it is working fine. There were ...
user avatar
  • 11
1 vote
1 answer
171 views

Avoiding carrying my main SIM card

In many countries, for example, Russia where I live, you need to show an ID to obtain a SIM card. Often this is used by law enforcement to track people. Sometimes corrupt officers sell people's ...
user avatar
  • 11
1 vote
1 answer
175 views

Protecting a PWA authentication token on a public kiosk device

I have a use case where I need a factory-reset tablet device to install and run a simple Progressive Web Application (PWA). The tablet will be mounted on a wall inside a company building that may host ...
user avatar
  • 113
0 votes
1 answer
166 views

Should certificate pinning be implemented if the app can use many servers?

In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application. The vendor sells software that it's customers ...
user avatar
  • 33
4 votes
2 answers
1k views

IoCs of Pegasus spyware penetration

What are the indicators of compromise (IoCs) that indicate methods used by the Pegasus spyware on mobile phones? How is penetration still possible when the latest and up-to-date OS of the phone is ...
user avatar
  • 560
0 votes
0 answers
232 views

Someone connected to my hotspot. Are my phone and laptop now compromised?

I have been using my android phone as a wifi hot spot for my laptop over the last few days so I can access the internet. I've been in a new location with no other personal devices nearby, and the hot ...
user avatar
  • 195
1 vote
1 answer
257 views

How to do ADB and user activity logging on Android?

My question is how to detect ADB connection or unusual user activity in shell on the Android devices. I have an Android 5.1.1 device with Wi-Fi hotspot enabled and also with opened ADB port, similar ...
user avatar
2 votes
1 answer
557 views

What is Trusted Credentials in mobile phones?

My phone is encrypted and i was just playing with the configuration and just found a Trusted Credentials that got me curious on what it is and specially in one called Government Root Certification ...
user avatar
0 votes
2 answers
164 views

How easily can ISP/mobile network operator employees read or decode traffic data?

When I sign up for a mobile subscription or internet connection with my ISP (also a mobile network operator), the company's privacy policy says that certain information is processed such as personal ...
user avatar
  • 51
0 votes
1 answer
265 views

Will GPS spoofing + VPN on mobile hide location?

Suppose I turn on "developer" mode on my Android mobile phone and install a professional GPS spoofing app and a professional VPN app. Developer mode will allow the GPS spoofing app to ...
user avatar
  • 115
1 vote
0 answers
97 views

Is Google OAuth login in 3rd party applications via system browser secure?

Numerous mobile applications allow me to "Login with Google". From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
user avatar
1 vote
2 answers
153 views

Are high traffic apps and websites used in DDoS attacks?

Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
user avatar
0 votes
2 answers
249 views

Is it possible to compromise a mobile phone just by using the telephone number?

In a recent tweet, a prominent UK journalist has claimed to have witnessed a European police force accessing content on a mobile phone just by using the telephone number. https://twitter.com/krishgm/...
user avatar
0 votes
1 answer
119 views

If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?

I have some questions about certificate pinning. Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
user avatar
  • 1
1 vote
1 answer
452 views

Verifying hardware-backed key pairs with Key Attestation

I am currently working through the Android tutorial about implementing Key Attestation. The tutorial can be found here: https://developer.android.com/training/articles/security-key-attestation In the ...
user avatar
1 vote
1 answer
260 views

Manage API key on mobile platform

As I am currently working a lot with mobile applications a question arised: How to properly store and transmit API keys within mobile applications? When I analyze mobile applications most of the times ...
user avatar
  • 228
1 vote
0 answers
80 views

I am finding the following link on my mobile past option once I restart or power on, any one knows what is it? [closed]

I am finding the following link on my mobile past option once I restart or power on, any one knows what is it? e-zfas5x9ao:...
user avatar
  • 11
1 vote
1 answer
85 views

Standard Protocols or secure mechanism to authenticate users offline

We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
user avatar
9 votes
1 answer
2k views

Certificate Pinning Best Practice or Alternative

I'm looking for the "best practice" to use in Certificate Pinning or an Alternative. Scenario:  I have a native mobile app and I have pinned the certificate so that the app can validate ...
user avatar
  • 165
1 vote
1 answer
510 views

How do I maintain/check a user session in the backend without having to use tokens?

I'm trying to login a user and, then, retrieve the user information like we do on a regular web app using php session. I have searched some solutions but I couldn't find any answer for my problem/...
user avatar
4 votes
4 answers
521 views

Is 2FA a false sense of extra security on a mobile phone?

I understand that 2FA increases security if you are using two different devices, for instance a computer and a mobile phone. I fail to understand how these security measurements help if you are doing ...
user avatar

1
2 3 4 5
21