Questions tagged [mobile]

Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].

Filter by
Sorted by
Tagged with
1
vote
2answers
76 views

Protecting payment mobile app against mobile theft

Currently I'm designing a payment app. It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
1
vote
0answers
946 views

What data is bitmoji keyboard collecting about me?

Bitmoji is a virtual keyboard for iOS and Android to create personalized emojis (very paraphrased). I've found a few blogs looking at the permissions it requests and the privacy policy that it shares ...
1
vote
2answers
3k views

Can infection effect a phone through it's wireless hotspot, also the usb tethering

If I made a wireless hotspot from my phone and had computers infected with malware connect and use my wireless connection of the phone can any malware from the pc get into the phone? If my phone was ...
3
votes
1answer
135 views

Call and Unsolicited One Time Passwords

Context: I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
0
votes
1answer
368 views

Can malware be installed on a mobile phone when the user opens an sms?

Is it possible for an adversary send malware over messages? I mean, when the victim clicks on the message sent by the attacker, a malware should be installed into his phone (in background). The hacker ...
2
votes
1answer
121 views

Identify anonymous mobile phone user by network participants

I have wondered this for quite some time but have not found any references. In the TV series "The wire" they use disposable prepaid mobile phones as a counter-surveillance technique. However if ...
6
votes
1answer
2k views

How secure are IMEI numbers?

I recently had my phone stolen (Galaxy S8) and have done the following: Wiped it remotely Reported the theft to network operator, who have allegedly blocked the IMEI I have tried searching for ...
0
votes
2answers
780 views

OTP generation is specific to SIM or Phone number

Are the messages including OTP sent to a mobile phone addressed to the SIM card or the phone number? If I decide to have a new phone number and the old phone number is allotted to a new customer, the ...
1
vote
1answer
235 views

Is showing the package name(Android)/bundle ID(ios) a security risk?

Suppose I release an app and accidentally publish the package name/bundle ID of the app which is suppose to be shown in development only, in a page. Is there any security concern that arises from this?...
1
vote
1answer
126 views

How does TrueVault's de-identification process work?

I'm thinking of using TrueVault, but I'm not entirely sure about the sequence of events involved in de-identifying data and re-identifying it. More info here. Here is the process, as I understand it, ...
2
votes
0answers
42 views

What is the right end-to-end process for transmitting/computing w/ HIPPA-compliant data?

Not a security expert so please excuse what may be a basic question. I am creating a health app that needs to be HIPPA compliant. I will of course hire a consultant later on, but I need a feel for how ...
4
votes
1answer
92 views

How is this registration setup vulnerable?

I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
64
votes
11answers
22k views

Why don't websites and devices offer fake logins for hackers?

I was thinking about this earlier this morning and was wondering why websites and devices don't offer fake logins for hackers? What I mean by that is that if a hacker finds out some of your details ...
1
vote
1answer
1k views

OAuth2 for mobile apps with confidential backend client (Is PKCE required?)

I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
3
votes
3answers
1k views

Why don't mobile devices let you change the IMEI number for better anonymity?

The vast majority of modern day mobile devices have a fixed IMEI number that's impossible to change, which makes it easy to track people if they use the same device constantly. It's quite easy to swap ...
5
votes
1answer
659 views

Can Signal encrypted voice calls be listened into by other apps?

Signal App (by Open Whisper) provides encrypted voice calls allowing two people to communicate via a data connection with secure encryption (assuming no MiTM attack). Given that Signal App uses the ...
1
vote
1answer
270 views

Shoulder surfing prevention or mitigation for unlocking mobile devices

How can shoulder surfing be prevented or mitigated when unlocking mobile devices? I found other questions about shoulder surfing that focus more on desktop machines, but I believe the issue is much ...
5
votes
1answer
185 views

Do app lockers improve smartphone security?

I recently installed Norton App Lock on my smartphone. It asks for a password pattern every time one tries to open an app. So, theoretically, it protects you in case someone is able to bypass your OS ...
1
vote
0answers
155 views

Restrict Public API To Access From Single App

I have a REST api on a server and an application for android phones that mostly makes calls to that api and presents the info to the user. Because the application needs to be a quick way to lookup ...
1
vote
1answer
173 views

somewhat complex dev domain https on local network cert problems

I was trying to mirror my setup to prod as much as possible so I only serve my dev site over https. The setup goes like this... I have a trusted CA on my machine made by devcert I generated some ...
1
vote
1answer
79 views

Outlook service is storing decrypted password in server memory – how insecure is it?

I am evaluating the possibility of using Outlook mobile client with an on-premise Exchange 2013 server. However it seems that the app sends quite a bit of data to Microsoft's cloud servers. It also ...
4
votes
3answers
475 views

Is it possible to identify mobile phone user with voice recognition

A friend of mine claims that it is possible to identify every anonymous call (prepaid, skype, etc) only using voice recognition. However the scientific literature which I've read so far is ambiguous, ...
1
vote
0answers
73 views

Password reset link was delivered via text not email, how and why? Any insight is appreciated [closed]

I think my smartphone is being hacked into + controlled by a third party, possibly my internet connection as well. Some very odd things have been ongoing for many months. On my phone I hear constant ...
0
votes
1answer
28 views

Privacy issue on corporate device

On my corporate phone which has my Exchange account. Browsing incognito on my home WiFi. Can my employer find out what I am browsing on an incognito page? I am using am iPhone.
0
votes
3answers
3k views

If you phone is seized, can you erase sim or stop them from cloning?

If your phone (for example, an iPhone) gets seized by the police, do they have sufficient technology to copy sim card (or any data) even if you cancel you provider and put phone in lost mode? If so, ...
1
vote
1answer
1k views

Long lived auth session for native mobile app

I’m working on mobile app which should have both good security and UX. My backend stores credentials on its side. There is no 3rd-party auth services. Also the app shouldn’t have web views as part of ...
1
vote
1answer
329 views

Can location/owner of mobile phone be identified

Let's say someone uses GSM network mobile phone to pursue his/her online activities on social networking platforms. The mobile phone is Android and all online activities are done through a VPN tunnel (...
2
votes
1answer
9k views

How to prevent "JailBreak detection bypass" by Cydia tools such as "Flex 3" etc?

For sensitive mobile apps such as banking applications, it is recommended to detect if the device is JailBroken and prevent the application from working on that device. But there are tools such as "...
2
votes
2answers
236 views

Self-signed certificates in mobile and desktop applications - are they enough? [duplicate]

I want to secure my data transfer using TLS between my own mobile and desktop client applications and my server. I am not at this time interested in web-based applications, so I don't really care that ...
2
votes
0answers
98 views

Apple iOS and KRACK

KRACK consist of several vulnerabilities (https://www.kb.cert.org/vuls/id/228519). Apple released patches against CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 from what I could find in their ...
3
votes
1answer
3k views

What would be the best way to authenticate a user in an offline, multi-user mobile environment?

I'm currently working on an offline authentication system for a multi-user mobile environment. In order to avoid storing all passwords locally, which seems to be a bad idea, I proceed this way: A ...
0
votes
3answers
642 views

Token FIPS 140-2 level 3 with support for Android, iPhone and Web

I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines. I would like to create applications that use level 3 tokens. Is ...
4
votes
0answers
2k views

What unique device fingerprinting information can an iOS 11 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
3
votes
1answer
779 views

Should I allow or block wireless devices from directly communicating with each other on my LAN AP?

The question I'm asking is, like all security, a bit open-ended, and ultimately - like all security - it involves a personal balance between ease/usability vs. risk/security: Should I let users' ...
1
vote
0answers
110 views

What are the security risks for applications using Cordova's webview on mobile?

I'm creating hybrid apps in Cordova. It creates a webview and renders HTML/JS/CSS content inside it on mobile phones, making it look like an app, but really it's just a local web page. Now I'm a bit ...
2
votes
1answer
968 views

Securing .so file access permissions

I work for a place that offers an encryption suite for Android apps in the form of a .so C library to be integrated in Android apps. The issue is that there are only two exported functions in the .so ...
4
votes
3answers
242 views

Problem with the security certificates on parents' WiFi

I went to my parent's house for Easter and my cousin asked me about why he started getting certificate errors on his iPhone. I didn't think much of it until I went to show my family an Android ...
0
votes
0answers
655 views

Android: Can you exploit a broadcast Receiver that receives a custom object from the intent?

The app I am trying to attack (under a legitimate bug bounty program of course) has the following code for its broadcast receiver: //From vulnerable app public void onReceive(Context paramContext, ...
74
votes
5answers
39k views

I gave my cell number to a stranger on the internet. Have I fallen victim to a scam?

I was playing an online game and I came in contact with this user. She was listed as from the same country as me (Egypt). So when she asked me for my cell phone number, I gave it to her. I figured it ...
65
votes
10answers
22k views

Should I be concerned about strange, new iPhone app appearing after repair?

I had my iPhone battery replaced in a phone repair shop. After collecting it, I noticed that there is a strange new app installed, some "Chinese" web browser. It has no alphanumeric name and nothing ...
-1
votes
2answers
650 views

Can it be traced that I connected to wifi after I have disconnected?

Yesterday I connected to the wifi at a friends house through my cellphone. After I have disconnected, can it ever be traced that I used the wifi?
0
votes
3answers
1k views

Is it possible to identify my cellphone model if I connect to wifi?

Would it be possible for the IT department to trace the model of my cellphone if I connect to the wifi provided by the company?
0
votes
2answers
1k views

Can lack of certificate pinning be considered a vulnerability?

The use of certificate (or public key) pinning can be considered as a good practice for defense in depth, since it protects an application from man in the middle and DNS hijacking attacks. But can it ...
1
vote
1answer
7k views

What's the risk in downloading a .pdf from a phishing email?

I've received an email which is an obvious phishing attempt. However, a .pdf has been attached which I want to open, just out of curiosity! What are the risks in downloading .pdf files from unknown ...
0
votes
1answer
91 views

Motion sensors - detectable when using mobile network?

Motion sensors are a good way to be informed of any activity at our house. Many modern motion sensors have the possibility to notify the user using an internet connection using Wi-Fi or even mobile ...
2
votes
1answer
455 views

How reliable is using Fingerprint sensor (iPhone/Android) for identity approval?

What I'm trying to achieve is a confirmation of transaction (not payment) with a fingerprint sensor. Pretty much like Google does in its Play store: Chose a product, click pay Approve your choice ...
2
votes
1answer
1k views

How do you get Geolocation information from the CellID field in the herrevad database from Google Mobile Services?

There's a database called herrevad, that can be found in /data/data/com.google.android.gms/databases. This database contains timestamped entries about (some of the) app activity of the phone. The ...
3
votes
2answers
2k views

Can users read client SSL certificates from a react native mobile apps APK?

I want to secure an API used by a react native app. If an authorisation header is sent, the user can read the request and access data. To avoid this I want to use SSL client certificates. Now if I ...
0
votes
1answer
352 views

Will this system stop scalping and only let users by a maximum of 25 tickets per person?

I'm building a ticketing system which is mobile-first. Which means that people will need to download and register (using phone authentication like WhatsApp) in my app before they can buy tickets ...
1
vote
0answers
73 views

Oauth2 for mobile apps vs Google Digital Asset Links

I'm working on new authentication service for my company. We've got web app (asp.net) and separate API. API is consumed by third party integrators and also by our own mobile apps. For mobile apps, ...

1
3 4
5
6 7
21