Questions tagged [mobile]

Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].

Filter by
Sorted by
Tagged with
3
votes
2answers
422 views

Can SIM card be locked to the specific equipment?

I'm curious if SIM card can be "personalized" to operate only in the specified mobile equipment in addition to usual PIN security. So the SIM extracted from "legitimate" phone and placed into ...
15
votes
2answers
2k views

What unique fingerprinting information can an iOS 10 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
3
votes
2answers
419 views

Possible Phishing Attempt?

I use an iPhone. Today I got a text from an unknown number starting from +65. The message was "your one-time Wifi password is xxxx and it’s valid for only 10 minutes". Thought it was a scam and ...
1
vote
1answer
71 views

Understanding TS 133 501 (5G) Step 2 of EAP-AKA'

I have a question dealing with the EAP-AKA' used in 5G to authenticate clients coming from a 3GPP-Network. I read the latest specification on ETSI. The problem which I have is based on Step 2 on Page ...
0
votes
3answers
159 views

What to do after opening a potentially malicious link on smartphone?

What must one do if they opened a malicious link? Warning: Please do not open the links below as they may be malicious. They have been deliberately mangled to prevent accidental opening I received an ...
1
vote
1answer
98 views

Avoiding carrying my main SIM card

In many countries, for example, Russia where I live, you need to show an ID to obtain a SIM card. Often this is used by law enforcement to track people. Sometimes corrupt officers sell people's ...
0
votes
0answers
18 views

Escrow Key required after restart (Macbook Air M1) (MDM)

I have Macbook Airs (M1; Big Sur) that even though they successfully enable FDE to a local user, after restart, the device requires the escrow key. The Airbooks are managed by an MDM which pushes the ...
1
vote
0answers
35 views

iOS: What are potential privacy issues with Intune device enrollment?

I work at a large corporation and don't know how the mobile device management (MDM) is configured (and also the settings can be changed dynamically). I have a personal iPhone and the employer wants me ...
1
vote
2answers
134 views

Scanning for malicious hardware on display replacement for a smartphone

I recently bought a replacement display for my smartphone on ebay from a national supplier. I later realized that it does not have the Huawei logo printed on it, but it is working fine. There were ...
5
votes
1answer
345 views

GSM - Implementing Cipher Mode Command on YateBTS

I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!? I use the combination of BladeRF x40 FPGA and ...
1
vote
1answer
50 views

Protecting a PWA authentication token on a public kiosk device

I have a use case where I need a factory-reset tablet device to install and run a simple Progressive Web Application (PWA). The tablet will be mounted on a wall inside a company building that may host ...
0
votes
1answer
167 views

Can MDM on an iPhone restrict custom keyboard usage?

I have an iPhone that runs 13.3.1 (latest at this time). It's a corporate phone and has an MDM profile installed. I've been using the phone for almost 2 years now with a custom keyboard (Google ...
2
votes
1answer
188 views

What is Trusted Credentials in mobile phones?

My phone is encrypted and i was just playing with the configuration and just found a Trusted Credentials that got me curious on what it is and specially in one called Government Root Certification ...
1
vote
1answer
102 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
7
votes
3answers
3k views

Are SIM proactive commands secure?

A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). ...
4
votes
2answers
506 views

IoCs of Pegasus spyware penetration

What are the indicators of compromise (IoCs) that indicate methods used by the Pegasus spyware on mobile phones? How is penetration still possible when the latest and up-to-date OS of the phone is ...
0
votes
1answer
67 views

Should certificate pinning be implemented if the app can use many servers?

In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application. The vendor sells software that it's customers ...
5
votes
1answer
869 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
1
vote
1answer
181 views

How to do ADB and user activity logging on Android?

My question is how to detect ADB connection or unusual user activity in shell on the Android devices. I have an Android 5.1.1 device with Wi-Fi hotspot enabled and also with opened ADB port, similar ...
0
votes
0answers
126 views

Someone connected to my hotspot. Are my phone and laptop now compromised?

I have been using my android phone as a wifi hot spot for my laptop over the last few days so I can access the internet. I've been in a new location with no other personal devices nearby, and the hot ...
2
votes
1answer
1k views

How do you get Geolocation information from the CellID field in the herrevad database from Google Mobile Services?

There's a database called herrevad, that can be found in /data/data/com.google.android.gms/databases. This database contains timestamped entries about (some of the) app activity of the phone. The ...
65
votes
10answers
22k views

Should I be concerned about strange, new iPhone app appearing after repair?

I had my iPhone battery replaced in a phone repair shop. After collecting it, I noticed that there is a strange new app installed, some "Chinese" web browser. It has no alphanumeric name and nothing ...
0
votes
2answers
1k views

Is there a way to secure an API key on iOS?

When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite ...
0
votes
2answers
80 views

How easily can ISP/mobile network operator employees read or decode traffic data?

When I sign up for a mobile subscription or internet connection with my ISP (also a mobile network operator), the company's privacy policy says that certain information is processed such as personal ...
0
votes
1answer
120 views

Will GPS spoofing + VPN on mobile hide location?

Suppose I turn on "developer" mode on my Android mobile phone and install a professional GPS spoofing app and a professional VPN app. Developer mode will allow the GPS spoofing app to ...
1
vote
0answers
54 views

Is Google OAuth login in 3rd party applications via system browser secure?

Numerous mobile applications allow me to "Login with Google". From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
3
votes
1answer
441 views

MSTG-PLATFORM-11: Prevent custom third-party keyboards on Android?

The MASVS states in section "V6: Platform Interaction Requirements" MSTG-PLATFORM-11: Verify that the app prevents usage of custom third-party keyboards whenever sensitive data is entered. ...
1
vote
2answers
96 views

Are high traffic apps and websites used in DDoS attacks?

Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
1
vote
1answer
219 views

What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?

I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
0
votes
1answer
52 views

If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?

I have some questions about certificate pinning. Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
2
votes
1answer
333 views

Offline mobile app data storage Guidelines, Standards

We are currently working on a project to develop an "offline" mobile application that synchronises data with our current cloud software solution that would allow field workers in potential mobile ...
0
votes
0answers
95 views

Dangers of switching sim from old phone to new one

I would like to know the dangers of switching an old sim card from an old phone to a new one. I recently got a new phone and a paranoia woke in me. Lets assume that the old phone was infected with ...
1
vote
3answers
3k views

Is it possible to track someone using their mobile number in the UK?

This is something I've wondered for a while - is it theoretically possible to track someone using their phone number in the UK? It's a classic Hollywood trope and I'm wondering just how much truth ...
0
votes
0answers
46 views

What level of PCI compliance is required, and who is responsible for having it, where a white label app is involved?

We have developed a mobile application that integrates with systems of record of our clients via a middleware application. This application, amongst other things, can integrate with product systems ...
0
votes
0answers
35 views

Figure out security and auth for mobile app which uses Firebase

I need a bit of help to figure/plan out this scenario: So for a mobile app I'm currently working on, the use case requires authenticating users via mobile number and OTP. So basically the user enters ...
135
votes
8answers
65k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
0
votes
2answers
169 views

Is it possible to compromise a mobile phone just by using the telephone number?

In a recent tweet, a prominent UK journalist has claimed to have witnessed a European police force accessing content on a mobile phone just by using the telephone number. https://twitter.com/krishgm/...
6
votes
1answer
211 views

Can an attacker who has gained control over my router compromise anonymity through Tor?

If an attacker manages to infect my router with malware and sets up an entry node, can they force my computer to connect to their entry node? If my computer does connect to their entry node, can they ...
4
votes
1answer
698 views

How do criminals change IMEI numbers

I read that mobile network providers can block IMEI numbers from most networks but I also read that criminals can change these IMEI numbers in order to regain access to a network. How is this done and ...
1
vote
1answer
159 views

Verifying hardware-backed key pairs with Key Attestation

I am currently working through the Android tutorial about implementing Key Attestation. The tutorial can be found here: https://developer.android.com/training/articles/security-key-attestation In the ...
6
votes
3answers
2k views

Does any tablet support remote attestation?

Some PCs come with a TPM. One of the nifty capabilities of TPMs is the ability to perform remote attestation. Remote attestation allows your computer to tell a third computer what software your ...
1
vote
1answer
104 views

Manage API key on mobile platform

As I am currently working a lot with mobile applications a question arised: How to properly store and transmit API keys within mobile applications? When I analyze mobile applications most of the times ...
18
votes
4answers
9k views

Securely erasing personal data from Android phone before selling

I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files. What should I do?
-3
votes
3answers
636 views

How is two step authentication done in Europe without SMS?

I've heard that SMS use for authentication in Europe isn't even close to how much it's used in the US. How do they do two step authentication when a user forgets their password? Is it as simple as ...
1
vote
0answers
44 views

I am finding the following link on my mobile past option once I restart or power on, any one knows what is it? [closed]

I am finding the following link on my mobile past option once I restart or power on, any one knows what is it? e-zfas5x9ao:...
1
vote
1answer
45 views

Standard Protocols or secure mechanism to authenticate users offline

We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
7
votes
1answer
920 views

Certificate Pinning Best Practice or Alternative

I'm looking for the "best practice" to use in Certificate Pinning or an Alternative. Scenario:  I have a native mobile app and I have pinned the certificate so that the app can validate ...
2
votes
1answer
967 views

Pen test cell-phones

A customer has asked me to conduct a pen-test on the phones of their employees. The customer's target are the text messages within their employees phones. The text messages are stored on the SIM for ...
0
votes
1answer
51 views

What are modern protections against mobile application cloning

I recently started thinking about an attacker which would clone a mobile application, and add some code which would do something malicious, e.g. credential theft. This cloned app would communicate ...
110
votes
9answers
79k views

Why can we still crack snapchat photos in 12 lines of Ruby?

Just came across this bit of ruby that can be used to decrypt Snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked without a problem, considering ...

1
2 3 4 5
21