649 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
1
vote
1
answer
60
views
Is there a way to safely deliver the SDK keys with the Android app?
I found out that no matter where the SDK keys are stored, there is still a simple way to get them. I have a feeling that as long as the keys are shipped together with the apk, they are not secured.
...
0
votes
0
answers
52
views
How to access in-memory variables of another Android app (e.g. field values) without root or emulation?
Is there any way to access in-memory variables or object field values (e.g. Delivery.dropoffZipCode) of another app, without root access, without modifying the target APK, and without using an ...
1
vote
1
answer
111
views
App rejected due to intent scheme vulnerability – which part of my code is problematic?
This is an app that uses WebView.
Currently, my priority has been to get the upload done, so I haven’t organized the code yet.
I’ve attempted to upload the app several times to Google Play Console for ...
1
vote
0
answers
100
views
AEADBadTagException error on user's device causing Mobile app to not open
User I have in closed testing of an app uninstalled our app, and re-installed it via the Google Playstore app link. I pulled their bug report off their phone.
I'm pretty sure this (snippet below) is ...
0
votes
0
answers
115
views
Unsafe Implementation of WebView SSL Error Handler
Recently we got the below mail from Google play for our app:
Issue found: Unsafe Implementation of WebView SSL Error Handler
Issue details
We found an issue in the following area(s):
Version code ...
0
votes
1
answer
62
views
Can android photo apps see all my photos?
All photo apps require permission to photos, to work properly.
Does this mean a malicious developer can upload users' photos to cloud, so he can see?
If that is possible, what prevents him from doing ...
0
votes
1
answer
71
views
Where to implement the encryption on access token in clean architecture of android?
I implemented the Symmetric encryption of access token using Android KeyStore, but where I must do encryption process
Repository class where I receive data from Remote.
View Model class after passing ...
4
votes
2
answers
664
views
Enabling "detectUnsafeIntentLaunch" in strictMode throws warning even for Implicit Intent with setPackage
I have enabled detectUnsafeIntentLaunch in strict mode to test for change while targeting for android SDK 35 in my SDK.
I have the following code where I send a broadcast and it is caught within the ...
1
vote
0
answers
90
views
SecureEditText in Android
Context: Fridum is a tool that can be used for penetration testing in Android. it can take a dump of an app's memory/heap and extract all strings.
Problem: I am using fridump to take a dump for my app ...
0
votes
1
answer
82
views
Implicit Internal Intent vulnerability showing up when Android app is pre-Launch to the Playstore
Recently i creat new app from playstore console and also upload new bundle but playstore mention security and trust issues like Implicit Internal Intent vulnerability. this issues shows following ...
6
votes
0
answers
331
views
Google Play console: AES-CMAC incorrectly flagged as "security and trust issue" / "app contains unsafe cryptographic encryption patterns"
Edit notes and updates below.
Re-post from https://support.google.com/googleplay/android-developer/thread/277993015 as Google Support FAQ answer 9450925 states to post this here. (https://support....
1
vote
2
answers
108
views
SmsBroadcastReceiver Intent Redirection Error
When I'm trying to publish my app on play store but im getting the intent redirection error in my broadcast receiver. Here is the related code.
class SmsBroadcastReceiver : BroadcastReceiver() {
...
0
votes
1
answer
63
views
How to secure my secret key of S3 AWS - Google Console Warning
I encountered an issue while using AWS S3 in my app to download a file from it. However, upon deploying my app on Google Play, I received a warning about a potential AWS authorization leak.
val ...
0
votes
0
answers
226
views
Possible ways to simulate tap input with android studio
I'm working on a remote access application (similiar to AnyDesk) to access mobiles on a lan network and use them with just your browser. At this point, I'm able to send the device display output via ...
1
vote
0
answers
104
views
Limiting the access of JNI file access to "just" one folder
If I launch some C code with the JNI in my Android application, is there a way I could limit that C code to access only a specific folder in my application folder, so sandboxing it to just a specific ...