IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google. For general information about Android, see wikipedia/Android

The open source nature of Android gives the security community a unique view into the security of one of the world's most popular operating systems.

At its core, Android runs a modified Linux kernel, and thus shares many fundamental security frameworks with the Linux OS. On top that, Android greatly extends the security model of Linux and has many security features that are unique to that platform.

In addition, Android comes bundled with lots of pre-configured software to give a great out-of-the-box user experience. Most of these 3rd party components are also open source, and many Android vulnerabilities are the result of vulnerabilities discovered in 3rd party components rather than in the Android OS itself.

1374 questions
13
votes
1 answer

Is it a good idea to sign into your Android TV using your regular google account?

So just got an Android TV box and I realized that I have to sign in. Was just wondering if it's a good idea to sign in using my regular google account which contains all my files in Google Drive, my emails in Gmail, my location history in Maps and…
Idale
  • 131
  • 1
  • 1
  • 3
11
votes
2 answers

Android built-in security for apps?

Whenever you go to Google's Play Store and install an app, a list of all the necessary access is shown and a confirmation to proceed with the installation is required. Let's imagine I would like to install Angry Birds: In-app…
user69377
11
votes
1 answer

Android Device Support Lifecycles

A key consideration for most computer platforms is the availability of security patches for vulnerabilities which inevitably arise with them. Are there any available resources which provide information on what Android security issues have been…
Rory McCune
  • 62,266
  • 14
  • 146
  • 222
11
votes
5 answers

How to effectively detect a rooted device on Android?

Nowadays for detecting a rooted device, some applications perform static checks such as for example the case of GoogleWallet https://www.joeyconway.com/blog/2014/03/29/android-detect-root-access-from-inside-an-app/. The problem is that it is not…
D4l3k
  • 213
  • 1
  • 2
  • 5
9
votes
3 answers

How much of a security issue discontinued vendor security patches are on Android?

As an example, the original OnePlus One has good LineageOS support, but the vendor security patches were seemingly discontinued three years ago: What are the security implications and is the vendor dropping support enough of a reason to buy a new…
user220244
  • 91
  • 4
8
votes
1 answer

Android Keychain: what is a system wide credential?

Android documentation about keystore system has a sub-section Choose between a keychain or the Android keystore provider, it says we should use the KeyChain API when we want system-wide credentials. What is a system wide credential? When should I…
b4da
  • 710
  • 1
  • 8
  • 21
7
votes
2 answers

How can I safely use an old Android tablet?

I own a Pixel C tablet, which currently has Android 8.1 installed. The Pixel C has officially been discontinued at the end of 2017, and received its last security update 2019. I would like to keep using it, since I only use it to watch YouTube…
user163495
7
votes
1 answer

Using the Android hardware-backed KeyStore

I wish to use the Android hardware-backed KeyStore, but I'm concerned about security and usability. From what I've read here, KeyStore gets wiped when the user changes the device lock, unless setEncryptionRequired() is omitted. For usability sake,…
user1118764
  • 441
  • 5
  • 12
6
votes
1 answer

How does an android device/os prevent me from getting root?

I have never used an android phone and so hopefully this is not a bad question to ask. I know on iOS the kernel itself is signed and so cannot be extended and all applications are signed. Hence I cannot ssh/telnet into it for example and getting a…
user220201
  • 903
  • 9
  • 23
6
votes
1 answer

Competitor app blocks our app, need a way to bypass their check

We have a taxi app which has been quite successful in Europe. But recently one of our competitors has started checking if our app is installed and if it is, theirs won't run until the user uninstalls our app from their phone. We initially did a few…
Nima
  • 161
  • 5
6
votes
2 answers

How can I ensure that an android app was installed on a physical device and not an emulator?

I want to avoid people installing the app on virtual devices. Is there any way to tell this? What is best you could do? Ideally what i want to prevent as a whole is one person or entity creating many accounts to analyze my service easily. The app is…
SaintJob 2.0
  • 171
  • 1
  • 5
6
votes
1 answer

Does Samsung's "Security Enhancements for Android" offer anything for consumers?

On many of its Android devices, Samsung encourages the user to accept updates for Security Enhancements for Android. Here is Samsung's official page on the updates: http://www.samsung.com/hk_en/support/skp/faq/1028007 The user is presented with…
End Anti-Semitic Hate
  • 3,144
  • 2
  • 27
  • 55
5
votes
1 answer

How does Android's security model differ from UNIX's?

In UNIX's security model, you log in as a user, and then every process you start can access everything that belongs to your user account - that is, the trust is based on the user account, not on the particular executable. But on my Android phone, it…
sashoalm
  • 587
  • 1
  • 4
  • 12
5
votes
1 answer

To what extent can Google access data in the standard Android storage locations without restriction?

Android docs lists a number of places to store data here. To what extent can Google access data in these places assuming the developer does not want them to have it? In other words, if I save a private piece of data in an app that I make in my…
jordanpg
  • 151
  • 3
5
votes
1 answer

Do modern Android devices provide access to their Secure Element in some way?

I'd like to know if the latest generation of Android devices provide an application with access to their Secure Element in some way (other than by way of the NFC interface, which is #1 application of the SE), preferably by implementing a keystore…
fgrieu
  • 1,231
  • 8
  • 19
1
2 3 4 5 6 7