Questions tagged [mobile]

Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].

107 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
15
votes
2answers
2k views

What unique fingerprinting information can an iOS 10 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
5
votes
1answer
335 views

GSM - Implementing Cipher Mode Command on YateBTS

I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!? I use the combination of BladeRF x40 FPGA and ...
5
votes
0answers
180 views

How to encrypt cookies in Xamarin?

I have a Xamarin application which creates a few files in /data/data/my.app.com/app_webview after using it. The problem is that the cookies file is a file which contains session cookies. According ...
5
votes
0answers
159 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
5
votes
1answer
866 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
4
votes
0answers
179 views

Deauthorization Bug in messenger application - How serious is this?

My question refers to a behavior on a production system with more than 100 million chat users. Some time ago I changed my account password and removed all devices connected to my account. The next day ...
4
votes
0answers
291 views

Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs?

Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to? Such targeted or ...
4
votes
0answers
2k views

What unique device fingerprinting information can an iOS 11 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
4
votes
0answers
77 views

What are commonly used security practices when writing a hybrid mobile app with a framework like ionic 2?

I'm new to hybrid app development and web development in general. Are there common coding practices/techniques I can use to ensure that I write code which does not put the end user at risk of ...
4
votes
1answer
3k views

Securing REST API for use by mobile apps

I developed a REST API whose clients are mobile apps/websites under my control (API is not open to anyone). Users log into my mobile app/website with their Facebook or g+ login. I'd like to secure ...
3
votes
1answer
365 views

MSTG-PLATFORM-11: Prevent custom third-party keyboards on Android?

The MASVS states in section "V6: Platform Interaction Requirements" MSTG-PLATFORM-11: Verify that the app prevents usage of custom third-party keyboards whenever sensitive data is entered. ...
3
votes
2answers
407 views

Can SIM card be locked to the specific equipment?

I'm curious if SIM card can be "personalized" to operate only in the specified mobile equipment in addition to usual PIN security. So the SIM extracted from "legitimate" phone and placed into ...
3
votes
0answers
86 views

Can I detect unique identifiers from random radio chatter?

I am trying to find out if I can uniquely identify smartphones (I would like to find constant identifiers such as IMEI) by passively sniffing the cellular data frequencies. I know that sensitive data ...
3
votes
1answer
375 views

Possible Phishing Attempt?

I use an iPhone. Today I got a text from an unknown number starting from +65. The message was "your one-time Wifi password is xxxx and it’s valid for only 10 minutes". Thought it was a scam and ...
2
votes
0answers
91 views

Is what fingerprint scanners in mobiles store a stealable value?

If a fingerprint scanner were a human it would probably be like this: take a photo of the finger presented for authentication check it against the original photo to determine if it's the same. This ...
2
votes
0answers
70 views

Can this possibly infected SMS have been delivered with a cell-site simulator?

Very recently, I had received a message containing this text: #E(£ΘULÆ;iFΩ¥bi:iFΩké¤V7ud£Φ M:ed9+FÅH9edYK6,ΘΔbr£1wÄ:mJi £ΦùÅΣMè£$¤Z9 B#ΨMÑ0tJ_¥ΦL2 Φ9#WLÆ7eh£Ç6IX2sf£9Ψ6 DΩ¥B....
2
votes
0answers
87 views

Can (the carrier of) a caller/callee see the position of the other ones mobile phone?

Someone came to me with the following request: He/She wants to drive somewhere without the employer knowing in his/her free time. If the employer will know about the drive, it will be bad for his/her ...
2
votes
0answers
41 views

How to give end users access to accounts previously only administered by managers?

I have a question about how to handle a somewhat unique authentication situation. We have an existing system with lots of users that have never had direct access to their accounts before. They have ...
2
votes
0answers
42 views

What is the right end-to-end process for transmitting/computing w/ HIPPA-compliant data?

Not a security expert so please excuse what may be a basic question. I am creating a health app that needs to be HIPPA compliant. I will of course hire a consultant later on, but I need a feel for how ...
2
votes
0answers
97 views

Apple iOS and KRACK

KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
2
votes
1answer
995 views

How do you get Geolocation information from the CellID field in the herrevad database from Google Mobile Services?

There's a database called herrevad, that can be found in /data/data/com.google.android.gms/databases. This database contains timestamped entries about (some of the) app activity of the phone. The ...
2
votes
0answers
208 views

Is SS7 attack traceable/detectable?

There is a lot of talk about SS7 attacks. Even if old article, but still interesting. But lets say, someone accessed my account which uses two-step authentication (SMS verification method) and I ...
2
votes
0answers
539 views

Mobile Device identification best practices

When mobile app connects to back-end and requests the data, back-end should be sure that requestor is one it pretends to be. So, we need some way to securely identify the app on a device. While ...
2
votes
1answer
332 views

Offline mobile app data storage Guidelines, Standards

We are currently working on a project to develop an "offline" mobile application that synchronises data with our current cloud software solution that would allow field workers in potential mobile ...
2
votes
0answers
755 views

Security risks/benefits of using Google voice?

A small business that handles sensitive information needs to implement a VOIP system that provides better security than the regular cellular network. What are the security risks/benefits of using ...
2
votes
0answers
73 views

Mobile processors with hardware support for efficient bounds checking

Are there any mobile or embedded processors that provide hardware support for efficient bounds checking? Intel's newest x86 processors provide MPX, which enables compilers to add automatic bounds ...
2
votes
0answers
2k views

End-To-End encrypted calls over GSM transport (not data / VoIP)

As the issue stands, it should be (or could be) possible, to encrypt voice, that's being passed through GSM voice call in such way, so that it's end-to-end encrypted. Ideally in form similar to what ...
2
votes
0answers
2k views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
2
votes
0answers
102 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
2
votes
0answers
212 views

Can a Tsunami early warning turn “on” remotely some cell phones in Japan?

In Japan, some televisions and radios seem to be capable of getting out of sleep mode if a tsunami warning is issued. If tsunami warnings are issued, the Emergency Warning Broadcast system ...
2
votes
0answers
558 views

How to know our mobile number or phone has been hacked?

We have a Xiaomi Redmi 2 phone and a sim card in it. Yesterday we started receiving angry and swearing text messages. we called the numbers back and apparently a mass angry text messages have been ...
2
votes
0answers
111 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
2
votes
0answers
118 views

Are old Android WebViews a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information. To mitigate this, ...
2
votes
0answers
1k views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
0answers
1k views

Security instructions for a mobile banking REST API

I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app. We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS ...
2
votes
1answer
123 views

How much of the FUD around jailbreaking has any merit?

So many security vendors and app providers warn us users against jailbreaking iOS devices. The fear mongering is often very dramatic. However I can't find real world examples of actual problems caused ...
1
vote
0answers
47 views

Is Google OAuth login in 3rd party applications via system browser secure?

Numerous mobile applications allow me to "Login with Google". From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
1
vote
0answers
122 views

Should I occasionally replace my SIM card for security reasons?

To be able to use mobile data (e.g. 4G/ LTE) and mobile telephony (e.g. VoLTE) services on my smartphone, I need to put a SIM card into my smartphone (I know embedded-SIM/ eSIM exists but let's ignore ...
1
vote
0answers
57 views

Storing cleartext password in iOS keychain

I'm having a webservice which I'm using for my app. The webservice is using cookies when authenticated. I want to give my users the option to login via TouchID for faster login. Therefore I'm storing ...
1
vote
1answer
65 views

Understanding TS 133 501 (5G) Step 2 of EAP-AKA'

I have a question dealing with the EAP-AKA' used in 5G to authenticate clients coming from a 3GPP-Network. I read the latest specification on ETSI. The problem which I have is based on Step 2 on Page ...
1
vote
1answer
199 views

What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?

I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
1
vote
0answers
135 views

Cell phone receiving text messages between an acquaintance and his girlfriend

An acquaintance was staying with us a short time ago and I let him use my cell phone to text his girlfriend and listen to music. A week ago he acquired a cell phone of his own. Completely different ...
1
vote
1answer
94 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
1
vote
0answers
81 views

Does a mobile VPN provide anonymity when using apps?

When employing a system-wide VPN on a smartphone, I understand that all web traffic is routed through that VPN. Browsing to a webpage in incognito mode would provide some degree of anonymity, but I'm ...
1
vote
0answers
52 views

Can an attacker spoof content provider, backup manager or wallpaper manager in Android?

We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app. So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
1
vote
0answers
57 views

Secure API access with mobile apps in restricted environments

In our current project, IT rules prohibit anything that is not PROD to be publicly accessible from the Internet. Access to development and review environments must be severely restricted. That said, ...
1
vote
0answers
283 views

Fuzzing of Mobile Applications

I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz. I searched on ...
1
vote
0answers
471 views

Android WebView JavaScript Enabled

I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
1
vote
0answers
90 views

What are the security implications of using an iPhone purchased in China

I recently bought an iPhone off Craigslist, but It's come to my attention that the phone was purchased by it's original owner in China (The model no is: A1528). Are there any security implications if ...
1
vote
0answers
229 views

How do third party providers remove the SIM lock on a mobile phone?

There are third party providers online who offer to remove the SIM lock on mobile phones, by emailing the unlock code. All they ask for is the phone's IMEI and the network provider's name. In one ...