Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google. For general information about Android, see wikipedia/Android

The open source nature of Android gives the security community a unique view into the security of one of the world's most popular operating systems.

At its core, Android runs a modified Linux kernel, and thus shares many fundamental security frameworks with the Linux OS. On top that, Android greatly extends the security model of Linux and has many security features that are unique to that platform.

In addition, Android comes bundled with lots of pre-configured software to give a great out-of-the-box user experience. Most of these 3rd party components are also open source, and many Android vulnerabilities are the result of vulnerabilities discovered in 3rd party components rather than in the Android OS itself.

1408 questions
43
votes
1 answer

Why is Firewire a bigger threat than USB?

This question notes that a person briefly connected an Android device to an Apple computer via USB, and one comment indicates that it would "quite possibly" be a risk: In theory, yes, in practice, probably not. If it had been a Firewire device,…
Torben Gundtofte-Bruun
  • 622
  • 1
  • 6
  • 11
42
votes
4 answers

How does Android L achieve strong encryption with a low entropy passphrase?

After upgrading to Android L on my Nexus 5, I was pleased to find that I can enable encryption using a pattern as the passphrase. However, it soon got me thinking. I'm guessing the encryption key is ultimately derived from the pattern which is very…
tangrs
  • 688
  • 5
  • 12
42
votes
7 answers

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal information on it. Question taken from:…
Chris Dale
  • 16,161
  • 10
  • 62
  • 97
42
votes
4 answers

Microsoft email servers "require remote control of Android device security features"

Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (outgoing). So I set it up like I always do with a…
voices
  • 1,829
  • 8
  • 24
  • 37
35
votes
4 answers

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. How can I make sure I am making a payment on a…
Adarsh Konchady
  • 453
  • 1
  • 4
  • 5
34
votes
3 answers

Security implications of rooting Android

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me question the underlying security model. Specifically, I…
dr jimbob
  • 39,772
  • 8
  • 98
  • 165
34
votes
9 answers

Security implication if android app can be installed on emulator

I am working on ensuring security of my company's product. We have a mobile version of the product. This question is for the Android version Background - Our product is a SaaS-based product and the app is meant to be used by different salespeople of…
Lexi champ
  • 343
  • 1
  • 3
  • 6
33
votes
2 answers

Can Android phone running without SIM card be tracked (localized) by police?

I am running an Android phone without a SIM card. I am using it for web surfing. Can the police localize my phone using the cell towers (BTS)? In other words, I know Android phones emit radiations even if there is no SIM inserted. Can the service…
yasserbn
  • 433
  • 1
  • 4
  • 5
32
votes
4 answers

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation vulnerabilities, which are mainly used for legitimate…
android user
  • 323
  • 2
  • 4
32
votes
1 answer

How does a refresh token help?

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected using access tokens and refresh tokens (much like…
qre0ct
  • 1,532
  • 3
  • 21
  • 32
31
votes
5 answers

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy to trick such apps. Given the monetary incentives,…
Nicolas Raoul
  • 1,276
  • 2
  • 12
  • 17
29
votes
4 answers

Bypass with wrong cvv of debit card and getting OTP

This is happening in Visa/MasterCard/American Express, etc. I tried checking in many payment apps and payment gateways that if I enter the correct debit card number, name, valid date, and wrong CVV number, I am able to receive OTP. however, the…
Akshansh Shrivastava
  • 429
  • 1
  • 4
  • 11
28
votes
2 answers

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

There are built-in functionalities to encrypt a storage on OS X ( FileVault ) and Android. On OS X: to enable encryption current user must have a password protected account. After enabling the encryption, recovery key is generated (something like…
user164892
27
votes
3 answers

Why do a lot of Android apps (like Linkedin) require many unrelated privileges?

I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data . Why does any application like Linkedin which is probably…
Adam A
  • 403
  • 5
  • 11
27
votes
2 answers

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

Between version 4.4 and 9, Android supported Full-Disk Encryption (FDE). On Android 7, a new system called File-Based Encryption (FBE) was introduced, and was subsequently made mandatory on Android 10. The primary upside cited in the page for…
user163495
1
2
3
…
93 94