Questions tagged [mobile-app]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
59 views

Secure Passwordless MFA authentication on mobile app

I want to secure my mobile app with a passwordless MFA mechanism. The registration/login flow would be: You register you account online with a username and a mobile phone (an OTP will be sent to ...
PinkWhaleRider's user avatar
0 votes
1 answer
88 views

How to securely use service account credentials in an Android App

I have an Android application distributed to my users through an .apk file. That app collects some data, and my goal is to upload that data to a cloud service, like BigQuery. To achieve this, I am ...
Jorge's user avatar
  • 1
1 vote
1 answer
283 views

Bypassing root detection qualify as a vulnerability?

I am working on security testing of an android application. There is a root detection in the Android application. objection, frida etc. It is possible to bypass this with ways. My main question is: ...
Exnovan's user avatar
  • 35
1 vote
0 answers
98 views

Is Android SOS being used as privilege escalation or settings bypass?

I have been getting random SOS countdowns triggered on my phone. Every time this happens, a pop-up appears telling me that unknown numbers have been temporarily unblocked. The most recent instance was ...
Miles's user avatar
  • 111
2 votes
0 answers
132 views

Storing encrypted data in iOS keychain

In my Unity app in C# I am using a 3rd party script which allows me store and retrieve data using iOS keychain. The stored data is a private user generated key which is used to encrypt data before ...
Ando's user avatar
  • 133
1 vote
0 answers
130 views

MobSF Android Activity APK Pentest

it is my first time with MobSF and Android APK assessment. I have found something while testing a specific APK and I am trying to understand the concept behind it: Under HARDCODED_SECRETS in MobSF, ...
Mr John's user avatar
  • 11
0 votes
1 answer
234 views

Are there IoT devices that send data home despite blocked internet connection (with the detour via bluetooth on the phone)?

I am increasingly buying IoT aka smart devices for my household. All these devices need to be connected to WLAN and proprietary app (via bluetooth on iPhone). I do this initial step, but then block ...
Sybil's user avatar
  • 1,469
2 votes
1 answer
70 views

Mobile App Security for Spotify [closed]

This is a little bit crazy. A long time ago, I created a Spotify account using Facebook credentials. A few years ago, I stopped my premium subscription, deleted Spotify from all devices and didn't ...
Ghassan Karwchan's user avatar
0 votes
1 answer
130 views

If software use encryption to protect one from ISP providers and other parties from snooping, how does this apply to browser software, esp. on mobile?

I believe the title says it all. As an example, let's say I use the Brave browser on a phone. From my understanding, all legitimate apps or computer software that connect to the Internet have some ...
Kyrill's user avatar
  • 1
1 vote
1 answer
114 views

How to deal with targeted attacks from publisher when verifying the integrity of native applications and validating their source code?

I am trying to reason about how native apps can avoid the problems web apps have in dealing with the "Browser Cryptography Chicken and Egg" problem, which has been discussed numerous times ...
tyhdev's user avatar
  • 13
0 votes
0 answers
111 views

How to use TokenAuthentication in mobile apps?

I'm working on a mobile application, using django rest-framework as backend, and I'd like to archive the maximum security possible. Now when the user log-in with email and password I generate a token, ...
Paul Rock's user avatar
  • 111
0 votes
1 answer
210 views

Downside of resource owner password flow for native mobile apps?

I have seen some similar questions a few years old and I am not sure if there are any new changing views on this. I see that this flow is not recommended for mobile native apps. What are the practical ...
jhurtas's user avatar
  • 101
3 votes
0 answers
343 views

Security of in-app Forgot Password workflow in Xamarin (Mobile App) without using a website

I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I've seen for any app is: User requests password reset ...
Varin's user avatar
  • 131
0 votes
1 answer
199 views

What's the threat model of mobile security? [closed]

When reading about mobile security, the attacker is often assumed to have root access to the device, so as to patch the application or proxy all network traffic. I see that such applications may have ...
Shuzheng's user avatar
  • 1,237
0 votes
2 answers
839 views

Why would a bus ticketing app require an Internet connection when you board the bus?

The bus company that I use (Arriva UK) is trying to persuade passengers to switch from buying paper tickets to tickets stored on their app. They are particularly pushing this for 'bus passes': tickets ...
Matthew's user avatar
  • 162
3 votes
2 answers
515 views

Protecting a PWA authentication token on a public kiosk device

I have a use case where I need a factory-reset tablet device to install and run a simple Progressive Web Application (PWA). The tablet will be mounted on a wall inside a company building that may host ...
sammy34's user avatar
  • 133
0 votes
1 answer
277 views

Pornographic image in Wikipedia app

I opened up the Wikipedia app on my iPhone today and saw that the featured article on the main page was on “Henry IV, Holy Roman Emperor”. However, the image displayed for the article was a closeup ...
Daniel Walker's user avatar
0 votes
1 answer
1k views

Man-in-the-Middle Mobile (e.g. Android) Application Tool

I'm trying to MITM an Android application but I cannot get it to work properly. Usually, I'm using Burp for those kind of attacks, which allows me to intercept and decrypt HTTPS traffic. (Assuming the ...
Azulath's user avatar
0 votes
1 answer
538 views

Will GPS spoofing + VPN on mobile hide location?

Suppose I turn on "developer" mode on my Android mobile phone and install a professional GPS spoofing app and a professional VPN app. Developer mode will allow the GPS spoofing app to ...
user avatar
2 votes
1 answer
265 views

Is certificate pinning enough to protect client (native mobile app) - server communication?

My use case is the following: I want to create an app with React Native that I can deploy on both iOS and Android. The app should consume an RSS feed (https call) from the server but there is no need ...
dierre's user avatar
  • 315
4 votes
4 answers
1k views

Is 2FA a false sense of extra security on a mobile phone?

I understand that 2FA increases security if you are using two different devices, for instance a computer and a mobile phone. I fail to understand how these security measurements help if you are doing ...
servi Servaas's user avatar
0 votes
1 answer
120 views

How do mobile apps share details with each other to show customized ads

My question is more towards how this is implemented. I mean do they expose apis to each other or store data at a common place to be accessed by others. Please excuse me if it seems too naive.
ThankYouSRT's user avatar
  • 1,345
0 votes
0 answers
920 views

Designing a user session API for both mobile and web clients

I'm currently working on a project. The apis on the backend will support both mobile and web clients. I'm attempting to design a user management flow for both clients and a bit confused about how to ...
EI-01's user avatar
  • 101
0 votes
0 answers
220 views

Repackaging Mobile app which resists repackaging

I tried repackaging an Android app but after installation, when I launch that app, the app crashes immediately. This is the exception I am getting when I decompile this application using apktool and ...
Nikhil_Coder's user avatar
1 vote
0 answers
433 views

Insecure Binary protection iOS Pentest Report

Thirdparty pentest company reported their findings in our iOS app. In the report explanation for this vulnerability is Apple provides default encryption for applications; however, the encryption ...
titus's user avatar
  • 111
4 votes
2 answers
921 views

MSTG-ARCH-7: All security controls have a centralized implementation

In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation". Now I'm struggling a bit by what ...
A security researcher's user avatar
3 votes
0 answers
249 views

Deauthorization Bug in messenger application - How serious is this?

My question refers to a behavior on a production system with more than 100 million chat users. Some time ago I changed my account password and removed all devices connected to my account. The next day ...
robusto's user avatar
  • 41
5 votes
1 answer
766 views

What questions are useful to scope a mobile app pen test?

When arranging a pen test it's common practice to ask the client a set of questions, and use the answers either as the basis for further discussions, or to directly provide a test plan and quotation. ...
paj28's user avatar
  • 33.4k
-2 votes
1 answer
173 views

Securing a read-only REST service for mobile access

I am writing a mobile app that uses a read only REST service that sits behind our company firewall. The actual data supplied by the REST service is not private but I am concerned with a hacker using ...
ponder275's user avatar
0 votes
0 answers
109 views

Security concern on locally stored authentication token

It is a common method on mobile applications to allow users to bypass authentication process by verifying a locally stored token (previously authenticated) on device. This is to strike a balance ...
Sayan's user avatar
  • 2,031
22 votes
7 answers
7k views

How to secure a mobile app against its user?

I have created a mobile application that monitors the accelerometer activity and based on that it rewards the user if a specific pattern is observed. How I can secure the application against the user ...
Noureddine's user avatar
0 votes
0 answers
20 views

How can I prevent my server from receiving requests for a modified application? [duplicate]

I am developing an android application and in the future also for IOS, and I use a server in PHP. Is it possible for my server to know the source of the application sending the requests? For example,...
Fernando VR's user avatar
5 votes
2 answers
513 views

What is the use case of request signing in this mobile app?

The API of a mobile app I was testing is sending the AWS AccessKeyId and SecretKey used for request signing from the AWS Cognito server unencrypted (apart from the regular TLS encryption). Making it ...
Martin Fürholz's user avatar