4
I would like to extend Joseph Sible's comment and build upon it.
There is a rule in Information Security, called "Never trust the client!", and it holds true so far. In your case, the client is the application on the phone of the attacker. The attacker has full access to the phone, and can modify it in any way they would like. This includes, but is not ...
3
No, because ACCESS_COARSE_LOCATION and ACCESS_FINE_LOCATION permissions can't turn on and access location services if they are disabled (assuming your phone isn't rooted). However, the app could still try to enable location services or find your location with other methods.
Vulnerabilities have existed to turn on location services without user interaction, ...
2
If you download the social media apps on the new phone from authoritative sources, I'm not sure how malware from another device could infect your new phone.
2FA would not help, because you would be logging into your accounts, and if there was some way to transfer the malware automatically, then it would happen after you used 2FA. Same thing for "changing ...
2
All files are just a string of bytes. An MP4 file means, depending on who you ask, a string of bytes that conforms to the MP4 standard, or that an MP4 player can do something with, or that has '00 00 00 18 66 74 79 70 6D 70 34 32' as the first twelve bytes (many file format standards always start with some fixed string of bytes so a program can look at just ...
2
From a security POV, you're exposing yourself to every security vulnerability that has been patched since you last applied updates. There's far too huge a number to really be aware of every single security flaw, but you can get a decent idea by looking at the List of Android Security Vulnerabilities and using the buttons at the top to include only higher ...
1
Some malicious applications do end up appearing on Google Play. Google tries to block malicious apps from entering, and does remove them from the market after they find, but it's not perfect system (I don't think you could have a 100% perfect vetting system that accepted "good" apps while keeping the "bad" ones, even if you had a human reviewing the source ...
1
However, actually how important is this lack of security updates for
an end-user?
Very very important.
Reading through Android security bulletins, often the updates fix
things that cannot be attacked unless you have either physical access
to the device or you are using a bogus app.
This is not true. The 2019 August Security bulletin itself talks ...
1
No, you cannot mitigate this vulnerability without a major change in hardware. If your adversary has the ability to dump memory from arbitrary processes, there is no way to store credentials confidentially. On Intel's x86 CPUs, a feature called SGX can be used to create a secure enclave that can hide data even from the kernel, but that is not a feature that ...
1
Depends on the risks you are trying to mitigate. General rule of thumb is that once the evil maid has access to the end point, it's not a trusted platform.
Free from irregular spyware and presumably no other untrusted devices
on the handset. The risk is to the confidentiality of your data
mainly I think. There is some risk to integrity and some to
...
1
1) Unless you know very well what you're doing (for example experience with malware reverse engineering) or you know the exact malware used, I would advise against this. I would say it's better to just format the phone outright.
2) How do you know that there is malware on your phone? This would help track down where you might want to look.
3) This website ...
1
Owasp dependency check is one of the ways to go. It downloads all the latest vulnerability listings for the dependencies and than checks your app dependencies against them.
Tool:
https://www.owasp.org/index.php/OWASP_Dependency_Check
Guide:
https://medium.com/@appmattus/android-security-scanning-your-app-for-known-vulnerabilities-421384603fc5
1
If we are talking in the way it is intended to use the answer is No, and that's why the setting is there.
Obviously there could potentially be known or unknown vulnerabilities through which you could abuse this, but that is out of scope of the question.
Keep in mind that Android Location services can have different modes as seen in the image below on ...
Only top voted, non community-wiki answers of a minimum length are eligible
