Questions tagged [mobile]

Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].

Filter by
Sorted by
Tagged with
133
votes
8answers
65k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
25
votes
2answers
943 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
33
votes
6answers
26k views

Ensure web service only accessed by authorized applications

Preface My mobile app allows users to create accounts on my service. In addition to being able to log in with external authentication providers, like Facebook, I want to give the user the option to ...
17
votes
2answers
3k views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
16
votes
1answer
3k views

How to protect from caller-id spoofing?

Yesterday, I listened about caller-id spoofing and was left astonished as its misuse can result in severe consequences for victim. Please tell me how to protect myself from this prank and is there ...
66
votes
1answer
33k views

How does end to end encryption work with whatsapp web?

Since today I have noticed whatsapp is using end to end encryption. However web.whatsapp.com is also still working. Does whatsapp establish a connection with my phone to keep things secure?
18
votes
4answers
52k views

What is the risk of leaking IMEI / IMSI numbers over a network

Should I worry if a developer programmed an app to send IMEI / IMSI number of the phone where the app is installed back to him? What can an attacker do with such information?
12
votes
2answers
208k views

What happens if an attacker steals my phone's IMEI number?

I have some questions regarding IMEI numbers and data and identity theft. While searching online I have found many conflicting answers regarding this topic and would like some clarification if ...
62
votes
4answers
18k views

Why do mobile devices force user to type password after reboot?

Nowadays, many mobile phones have supported unlocking through fingerprint recognition. However, both iOS and Android require users to enter the password after the device is rebooted, even though an ...
23
votes
2answers
8k views

How do anti-virus apps for Android work?

There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
10
votes
1answer
989 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
8
votes
1answer
1k views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
10
votes
4answers
8k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
18
votes
1answer
727 views

What unique device fingerprinting information can an iOS8 app collect?

As an addition to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy/security vulnerabilities still exist as of iOS 8? Can ...
5
votes
10answers
1k views

Can a compromised mobile phone be used to penetrate a desktop or server?

Can a compromised mobile phone be used to penetrate a desktop or server, such as when you plug the phone into the server or desktop for plug and play? I don't know what protocol the transfer is there....
14
votes
5answers
19k views

QR codes that can't be copied - possible?

I assume this is impossible, but I need to find a barcode (that can contain a url, i.e., a QR style one). It has to be photographed by our smartphone app, but the image will not be changed over a ...
6
votes
6answers
8k views

Blocking insecure iPhones from accessing ActiveSync

Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint? In ...
531
votes
18answers
114k views

Police forcing me to install Jingwang spyware app, how to minimize impact?

Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it. Knowing that I may be ...
39
votes
5answers
88k views

How to trace a (mobile) phone?

Even since growing up, I've watched films in which the "bad guy" is repeatedly tracked down when they call the police or FBI or police force de jour. They always have "about 30 seconds". Regardless ...
34
votes
3answers
3k views

Security implications of rooting Android

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me ...
42
votes
7answers
44k views

Can a powered down cell phone be turned on remotely?

I know this is tin-foil hat fodder, but at least one judicial opinion referenced a bug that could track/listen in on the subject "whether the phone was powered on or off," although that may have been ...
16
votes
6answers
21k views

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
13
votes
5answers
20k views

Is it possible for a phone to be transmitting even while turned off and the battery removed?

Is it technically or theoretically possible for any part of a mobile phone's circuitry to be still on and transmitting even while turned off and the battery has been removed? If so, how? I am ...
15
votes
3answers
9k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
10
votes
5answers
3k views

Protect application from being modified

I have a question about how to detect a program/binary modification assuming the program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but ...
19
votes
4answers
14k views

Is Android's Password Screen Lock Enough Data Theft Protection?

With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply by-...
25
votes
6answers
6k views

Why do apps with phone verification send the user a message, rather than have the user send one to them?

Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
6
votes
4answers
7k views

Are the iPhone “connect the dots” passwords secure?

A popular way to login to iPhones and other phones is to use a "connect the dots" password. For those unfamiliar, it looks something like this: Is this kind of passwords secure from brute force ...
41
votes
7answers
5k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
29
votes
5answers
72k views

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy ...
43
votes
6answers
5k views

Why do mobile apps have fine-grained permissions while desktop apps don't? [duplicate]

Androids apps use fine-grained permissions for security reasons, iOS apps (afaik) do it as well. Windows 8.1 applications don't have a permission schema like that, all Linux versions which I have ...
74
votes
5answers
39k views

I gave my cell number to a stranger on the internet. Have I fallen victim to a scam?

I was playing an online game and I came in contact with this user. She was listed as from the same country as me (Egypt). So when she asked me for my cell phone number, I gave it to her. I figured it ...
15
votes
4answers
14k views

How do you find out if a phone is secretly sending private data to a remote server?

I read a recent article on a Chinese phone manufacturer on Wall Street Journal that says: The rumors had begun when a user posted online in mid-July that his RedMi Note smartphone was “secretly” ...
35
votes
4answers
8k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
16
votes
4answers
5k views

What risk does Carrier IQ pose, exactly?

There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out. My questions: What exactly does Carrier ...
5
votes
1answer
43k views

How to track a Spoofed SMS on Iphone

A mate pulled a quality prank on me the other day by sending me a SMS via a Spoofed number. He's bought a SMS gateway and can set the message ID/phone number to be 'God' (or whatever he wants(letters ...
17
votes
5answers
3k views

Android API/development security pitfalls

What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
11
votes
3answers
4k views

Someone is making random calls spoofing my phone number. What to do?

For the past six months, I've experienced call-backs from foreign numbers (all within the EU) telling me that I had called them earlier. At first, I thought the calls are malicious. However, due to ...
11
votes
4answers
8k views

Self sign SSL certificate for my mobile app?

My mobile (iOS and Android) connects to my server via a REST API over HTTP. I would like that HTTP to be secure, so HTTPS seems to be the obvious choice. All of the questions about self signing SSL ...
1
vote
2answers
5k views

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
12
votes
4answers
1k views

Vulnerabilities common only in mobile solutions?

I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier. I haven't heard of any serious or common problems that ...
7
votes
4answers
2k views

How effective is iPhone 3GS and 4 device-at-rest encryption?

My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device. In that context how effective is iPhone 3GS and 4 encryption?
5
votes
7answers
3k views

What security risks exist in cell phone apps' data transfer?

Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not ...
4
votes
1answer
5k views

iOS application pentest without jailbreak

Is it possible to run a security assessment on an iOS application using a non-jailbroken device? My device was recently restored (recovered - no SHSH blobs) to iOS 8.4.1 (as Apple doesn't like ...
43
votes
6answers
44k views

What is preventing us from sniffing the mobile phone communication?

I'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air ...
24
votes
7answers
28k views

What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?

I'm interested in updating this two pronged question for 2011: What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective? What cryptology is most ...
67
votes
4answers
70k views

Are there any security risks in replying to an SMS message?

I routinely receive seemingly harmless SMS messages from unknown people. They're usually simple, like "Hi" or "Hello" or "Are you there?". This happens several times a week, and certainly often enough ...
31
votes
1answer
6k views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
10
votes
2answers
25k views

How does mobile free internet bypass works? (UBT / FBT)

I have encountered a mobile application named "HTTP Injector" which lets you get free internet access (UBT / FBT). The process to get it work and receive free internet seems to be as follows: ...
13
votes
3answers
5k views

iOS/Android Pen-Test

This question might be vague, that is because I am not sure where to start. There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...