New answers tagged android
2
Flash memory could be read externally by a very determined attacker, but probably a random pickpocket isn't going to bother. Full disk encryption would eliminate that possibility.
An unlocked bootloader would allow simply changing the device password from a recovery environment, but given that your phone's bootloader is not unlocked and bootloader exploits ...
0
If you are worried that the client can fall in malicious hands, take into account that you app can be instrumented such that the certificate is still valid, but the payload is manipulated and/or stolen.
Consider two distinct scenarios:
To instrument your app such that the certificate for mutual TLS is still valid, but the data is manipulated and/or ...
5
A sophisticated threat actor could potentially exploit adb's key file permissions by switching your phone MOBO to another same model phone and some tinkering.
From then on, provided he knew how to get there, even an encrypted device might be under threat of full decryption.
The key factor here is the fact nothing is encrypted.
Basically, any kid with ...
0
Whatsapp asynchronous messaging and calling use different protocols for communication. For messaging it uses XMPP and for VoIP it uses SRTP for multimedia communication.
Both can be distinguished by their different traffic fingerprints. SRTP uses UDP as transport protocol and media elements are end-to-end encrypted. While directly analysing the UDP header ...
5
Without full-disk encryption, your unencrypted data can be read without recovering the pincode. Enabled USB debugging, definitely, extends the attack surface, but it's not necessary for a determined and skilled thief.
But most likely, they will wipe everything and resell your phone to get the daily dose.
1
ISPs in general can detect VoIP connections because these network flows in general have specific network metrics such as , constant rate, a relationship between up stream and downstream and some more. However, some applications such Skype the embed all encrypted traffic on one network flow, make impossible to know how many messages has been sent. In the case ...
4
While mutual TLS and certificate pinning are intended for different problems they can be used to solve the specific problem of detecting active MITM too. Only, with mutual TLS it is the server which detects the MITM (client certificate not as expected) while with certificate pinning it is the client (server certificate not as expected).
Implementation ...
2
If your phone is powered on during access, and they have a way to get past your lock codes, I don't see why not.
In the end, phones nowadays are just computers, and if you give someone else physical access to your computer, it's not your computer anymore.
One example would be that the attacker disables the 3d party APK install protection and downloads his ...
0
There is Safety Net Attestation API of Google play services by which we can assess the device and determine if it is rooted/tampered.
Please go through my answer to deal with rooted devices:
https://stackoverflow.com/a/58304556/3908895
0
I hope this is some automatically decompiled code because it's horrendous to read.
Since the Runnable object is retrieved from a key/value map (the intent object) you could force a custom runnable into the intent map at the specific key "EXTRA_BUY_TAB_START_POSITION_EXPLORE" so that it would be run after 500ms.
In you code you need to clarify :
What is ...
0
As @Steffen says, unless there's some horrible vulnerability with the CAC card, you shouldn't be able to extract the private key from an existing card. That's kind of the whole point of those things.
That said, at card creation time, you could load the same private key into a physical CAC card and into the Android device (assuming that your department ...
1
The CAC seems to be a typical smartcard where the private key is stored on the card itself and crypto operations involving the private key like signing are also done on the card. Such smartcards do not allow extraction of the private key. In fact, that is the main purpose of these cards that any use of the private key should explicitly require physical ...
0
With your code, an attacker will not be able to forge a valid message for your system. Yet she can still copy a (valid) message you've created and paste it on any other tag or restore to a previous state.
This means that this is possible:
Restore the account balance (if it's what stored on the tag) to what was before the purchase (simply by copy the tag ...
Top 50 recent answers are included
