Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

4
votes
3answers
2k views

What OS's will “brick” a stolen phone; preventing their use or resale by a potential thief?

You can look at this question in two ways: Prior to purchasing a used phone, I want to ensure that the IMEI is not locked and I'm able to use it fully. Or you can be a purchaser who wants to devalue ...
6
votes
2answers
454 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
5
votes
2answers
114 views

Secure sensitive information sent from Server to mobile App

Okay, I have a rails backend server which is pretty much just a database server. The database contains information about different types of a substance, and that substance's confidential inherent ...
2
votes
2answers
83 views

Apple's OTA update process

When reading the iOS security doc, on page 6, it discusses the OTA update process. The OTA process, includes sending information of current version and device ID to Apple. Inside the OTA response, ...
6
votes
1answer
179 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, etc)...
2
votes
1answer
32 views

Storage of account password on keychain iOS to enable TouchID login

Currently in the middle of a rather long-winded process of deciding upon the use of TouchID within an application being developed due, to security concerns, and wondered if anyone had any advice? The ...
2
votes
1answer
86 views

Is it possible to know imei number of other mobile using any sort of wireless technology?

Are there methods to grab imei numbers of mobiles irrespective of smart or ordinary using Bluetooth or similar wireless technologies. Case : other mobile may not have Bluetooth or possibly switched ...
0
votes
1answer
41 views

Remote Biometric Authentication using mobile phones

As Google endeavours to do away with passwords, biometrics authentication as a method of proving identity has gained popularity. Logging into a system using a fingerprint or other biometric data would ...
0
votes
1answer
55 views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
0
votes
1answer
99 views

Securing Internal Mobile REST API

I am planning to create an internal API for mobile devices for a company. They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
-1
votes
1answer
36 views

How to implement security with Azure Mobile Services Back-end?

I have a mobile application which relies on a Windows Azure Mobile Services Back-end. I want to tie down some security vulnerabilities. For example, someone can currently access all my records, modify ...
-1
votes
1answer
144 views

Does WhatsApp use certificate pinning?

Does WhatsApp use certificate pinning? I found a post by Preatorian Security from February 2014 that points the lack of certificate pinning as a major security problem, and mentions: Update 02/21/...
-2
votes
1answer
89 views

Regarding Mobile Application Penetration Testing

I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices. Why and why not? I have searched ...
4
votes
0answers
206 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
3
votes
0answers
67 views

Is the iPhone vulnerable to the BadUSB malware?

Supposedly, the BadUSB malware can infect any USB device. But I find this hard to believe since I don't see why most USB devices would have reprogrammable firmware and I find it even harder to believe ...
3
votes
0answers
31 views

In mobile, can “Early Media” be sent from the phone?

Early Media, aka in-band information, is sent from the network to the calling phone in some circumstances, to provide alternative tones or extra information about the status of the call. In GSM this ...
3
votes
0answers
80 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
3
votes
0answers
437 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
0answers
60 views

Is it possible to overwrite a phone through physical means?

I am currently doing some research into the Apple vs FBI controversy. During my research, I found a Edward Snowden comment that claimed that the government can actually override a phone's data, ...
2
votes
0answers
77 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
2
votes
0answers
64 views

Can a Tsunami early warning turn “on” remotely some cell phones in Japan?

In Japan, some televisions and radios seem to be capable of getting out of sleep mode if a tsunami warning is issued. If tsunami warnings are issued, the Emergency Warning Broadcast system ...
2
votes
0answers
90 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
2
votes
0answers
87 views

Are old Android WebViews a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information. To mitigate this, ...
2
votes
0answers
822 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
0answers
1k views

Security instructions for a mobile banking REST API

I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app. We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS ...
1
vote
0answers
17 views

How strong is the state-of-the-art in real-world “implicit authentication” systems?

Years ago, I read a paper about how mobile devices made it possible to authenticate users without entering a password, simply by relying on behavior, habits, locations. Now, the DoD plans to use such ...
1
vote
0answers
38 views

What information about a user can wireless carriers access?

What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more? IMEI,...
1
vote
0answers
37 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
1
vote
0answers
32 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
1
vote
0answers
36 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
1
vote
0answers
109 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
1
vote
0answers
177 views

How to know our mobile number or phone has been hacked?

We have a Xiaomi Redmi 2 phone and a sim card in it. Yesterday we started receiving angry and swearing text messages. we called the numbers back and apparently a mass angry text messages have been ...
1
vote
0answers
86 views

Possible to use Cellular encryption data to validate Geolocation?

I need offline-verifiable, time stamped, GPS signals or its equivalent. Since cellular protocols include time stamps, encryption keys and other data, perhaps it's possible to re-use this ...
1
vote
0answers
97 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password ...
1
vote
0answers
45 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
1
vote
0answers
38 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
1
vote
0answers
887 views

Securing REST API for use by mobile apps

I developed a REST API whose clients are mobile apps/websites under my control (API is not open to anyone). Users log into my mobile app/website with their Facebook or g+ login. I'd like to secure ...
0
votes
0answers
46 views

How do I decrypt Facebook's Messenger SSL traffic on Android?

I would like to investigate the Messenger chat protocol, and to do so i need to see it in clear... I've been able to successfully sniff the (not encrypted) traffic with the 'Shark for Root' but it ...
0
votes
0answers
32 views

Security code review Apple Swift - tools and documentation

I need to perform a security code review on a huge Swift application. I have done many mobile penetration tests before and some code review but never on iOS Swift Apps. I am primarily looking for ...
0
votes
0answers
32 views

Encrypt data on mobile device by retrieving keys from server using PIN

I need to securely encrypt persistent data on a mobile device, hiding it from hacking tools. What vulnerabilities are there in this method? Encryption: user sets 4 digit PIN to "protect" data on ...
0
votes
0answers
16 views

Which bytes in an OTA Command Package are encrypted with the KIc by 3DES CBC?

I have an un-ciphered OTA message in clear and I am trying to cipher it so it becomes secure data. The cryptographic checksum is already generated as part of the un-ciphered OTA message. I have the ...
0
votes
0answers
76 views

For multiple clients it's better symmetric or assymetric encryption?

I'm a newbie in the encryption world so I'm here for asking which is the best solution between Symmetric and Asymmetric encryption. In our use cases, we have multiple clients that must be ...
0
votes
0answers
45 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
0
votes
0answers
472 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
31 views

GPS security standards

Are there any GPS (global position) security standards to secure any kind of GPS implementation? For e.g GPS software coding standards, GPS traffic encryption standards? I asked because nowadays there ...
0
votes
0answers
27 views

What is more secure for Authentication: PostMessage or Redirect

Apple iCloud has the option to either PostMessage or Redirect upon authentication. Which is more secure, and why?
0
votes
0answers
119 views

Cellular Mobile ID number Sniffing

As far as I know, cell phones intermittently transmit a Mobile ID number to inform surrounding cell towers that the phone is available. Is this transmission encrypted, or would one be able to ...