Multiple Address Bar Spoofing Vulnerabilities In Mobile Browsers (Safari, Yandex for Android, Opera Touch for iOS, UC Browser for Android, Opera Mini Android, RITS Browser and Bolt Browser iOS)
https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html
https://www.rafaybaloch.com/2020/10/multiple-address-bar-spoofing-vulnerabilities.html
Miscellaneous Ramblings of a Cyber Security Researcher
Multiple Address Bar Spoofing Vulnerabilities In Mobile Browsers
Explore expert insights on pentesting/bug bounty hunting on this blog, your go-to resource for cutting-edge web security research.
HID attack against PC with Android
This is HID (Human Interface Device) attack against Windows 10, using Samsung S7 (HID) that downloads and executes Metasploit payload by hijacking its keyboard. The second Android device is running meterpreter listener and once payload is launched, device is owned
https://www.instagram.com/p/CGrXqKxg41l/
This is HID (Human Interface Device) attack against Windows 10, using Samsung S7 (HID) that downloads and executes Metasploit payload by hijacking its keyboard. The second Android device is running meterpreter listener and once payload is launched, device is owned
https://www.instagram.com/p/CGrXqKxg41l/
Instagram
Android Security & Hacking
Hacking PC with Android This is HID (Human Interface Device) attack against Windows 10, using Samsung S7 (HID) that downloads and executes Metasploit payload by hijacking its keyboard. The second Android device is running meterpreter listener and once payload…
New education article: all about attacks on Android implicit intents
https://blog.oversecured.com/Interception-of-Android-implicit-intents/
https://blog.oversecured.com/Interception-of-Android-implicit-intents/
News, Techniques & Guides
Interception of Android implicit intents
Explicit intents have a set receiver (the name of an app package and the class name of a handler component) and can be delivered only to a predetermined component (activity, receiver, service). With implicit intents, only certain
Android arbitrary code execution
Frida noscript that helps to identify potential ACE dynamically
https://github.com/androidmalware/android_frida_noscripts#1-file_existsjs
Frida noscript that helps to identify potential ACE dynamically
https://github.com/androidmalware/android_frida_noscripts#1-file_existsjs
GitHub
GitHub - androidmalware/android_frida_noscripts
Contribute to androidmalware/android_frida_noscripts development by creating an account on GitHub.
Samsung S20 - RCE via Samsung Galaxy Store App
https://labs.f-secure.com/blog/samsung-s20-rce-via-samsung-galaxy-store-app/
https://labs.f-secure.com/blog/samsung-s20-rce-via-samsung-galaxy-store-app/
Getting remote access to PC with Android via USB
https://youtu.be/PJbqZm73MOc
https://youtu.be/PJbqZm73MOc
Link previews in chat apps can cause serious privacy problems
There were found several cases of apps with vulnerabilities such as: leaking IP addresses, exposing links sent in end-to-end encrypted chats, and unnecessarily downloading gigabytes of data quietly in the background
https://www.mysk.blog/2020/10/25/link-previews/
There were found several cases of apps with vulnerabilities such as: leaking IP addresses, exposing links sent in end-to-end encrypted chats, and unnecessarily downloading gigabytes of data quietly in the background
https://www.mysk.blog/2020/10/25/link-previews/
Mysk Blog – In-Depth Cybersecurity & Mobile App Privacy Research
Link Previews: How a Simple Feature Can Have Privacy and Security Risks
Link previews in chat apps can cause serious privacy problems if not done properly. We found several cases of apps with vulnerabilities such as: leaking IP addresses, exposing links sent in end-to-end encrypted chats, and unnecessarily downloading gigabytes…
On Google Play were found 21 gaming apps that were packed with hidden adware
https://blog.avast.com/new-malware-apps-on-google-play-avast
IoC: https://docs.google.com/spreadsheets/d/1Cu6KVYG6VWWCZMY0A-vXlewXyfm7yd0djQtTzc82cyY/edit#gid=0
https://blog.avast.com/new-malware-apps-on-google-play-avast
IoC: https://docs.google.com/spreadsheets/d/1Cu6KVYG6VWWCZMY0A-vXlewXyfm7yd0djQtTzc82cyY/edit#gid=0
Avast
Another 21 malware apps found on Google Play
Avast has uncovered another set of malicious apps in the Google Play Store. While adware is hidden by design, there are steps each person can take to protect themselves and their families.
Android banking malware grew in Q3 with its detections more than four times compared to Q2
https://www.welivesecurity.com/wp-content/uploads/2020/10/ESET_Threat_Report_Q32020.pdf
https://www.welivesecurity.com/wp-content/uploads/2020/10/ESET_Threat_Report_Q32020.pdf
DoNot Android APT group targets India, Pakistan and the Kashmir crisis
https://blog.talosintelligence.com/2020/10/donot-firestarter.html
https://blog.talosintelligence.com/2020/10/donot-firestarter.html
Cisco Talos Blog
DoNot’s Firestarter abuses Google Firebase Cloud Messaging to spread
By Warren Mercer, Paul Rascagneres and Vitor Ventura.
* The newly discovered Firestarter malware uses Google Firebase Cloud Messaging to notify its authors of the final payload location.
* Even if the command and control (C2) is taken down, the DoNot team…
* The newly discovered Firestarter malware uses Google Firebase Cloud Messaging to notify its authors of the final payload location.
* Even if the command and control (C2) is taken down, the DoNot team…
How to monitor Wi-Fi networks using Samsung S7 (link with tutorial, how to install NetHunter, prerequisites, wifi adapter support list, ROM)
https://www.instagram.com/reel/CHF3snlAOOa/
https://www.instagram.com/reel/CHF3snlAOOa/
👏1
Lockscreen and Authentication Improvements in Android 11
https://security.googleblog.com/2020/09/lockscreen-and-authentication.html
https://security.googleblog.com/2020/09/lockscreen-and-authentication.html
Google Online Security Blog
Lockscreen and Authentication Improvements in Android 11
Posted by Haining Chen, Vishwath Mohan, Kevin Chyn and Liz Louis, Android Security Team [Cross-posted from the Android Developers Blog ] ...
How to identify dynamically loaded binaries in Android apps. Useful for Bug Bounty and malware analysis of dynamically loaded payloads
Commands
# ps | grep "APP_NAME"
# cat /proc/PID/maps | grep "/data/data/"
Demo: https://www.instagram.com/tv/CHXv3iBAJ5V/
Info: https://sayfer.io/blog/dynamic-loading-in-android-applications-with-proc-maps/
Commands
# ps | grep "APP_NAME"
# cat /proc/PID/maps | grep "/data/data/"
Demo: https://www.instagram.com/tv/CHXv3iBAJ5V/
Info: https://sayfer.io/blog/dynamic-loading-in-android-applications-with-proc-maps/
Sayfer
Detecting Dynamic Loading in Android Applications With /proc/maps - Sayfer
Through dynamic loading malware authors can covertly load malicious code into their application in order to avoid detection. We can detect such loading...
New Android banking trojan - Ghimob - targets 122 financial institutions mainly in Brazil
https://securelist.com/ghimob-tetrade-threat-mobile-devices/99228/
https://securelist.com/ghimob-tetrade-threat-mobile-devices/99228/
Securelist
Ghimob: a Tétrade threat actor moves to infect mobile devices
Guildma's new creation, the Ghimob banking trojan, has been a move toward infecting mobile devices, targeting financial apps from banks, fintechs, exchanges and cryptocurrencies.
Joker’s New Tricks: Using Github To Hide Its Payload
https://www.trendmicro.com/en_us/research/20/k/an-old-jokers-new-tricks--using-github-to-hide-its-payload.html
https://www.trendmicro.com/en_us/research/20/k/an-old-jokers-new-tricks--using-github-to-hide-its-payload.html
Trend Micro
An Old Joker’s New Tricks: Using Github To Hide Its Payload
We recently detected a new version of the Joker mobile malware on a sample on Google Play. This update utilizes Github pages and repositories in an attempt to evade detection.
👍1
XPCSniffer dumps XPC information to a file and the console #iOS
https://github.com/evilpenguin/XPCSniffer
https://github.com/evilpenguin/XPCSniffer
GitHub
GitHub - evilpenguin/XPCSniffer: Sniff XPC goodies on your iOS device.
Sniff XPC goodies on your iOS device. Contribute to evilpenguin/XPCSniffer development by creating an account on GitHub.
VivaVideo Android app is responsible for unwanted premium subnoscription fraud and invisible ads
https://www.upstreamsystems.com/27-million-premium-subnoscription-fraud-and-invisible-ads-within-vivavideo-identified-by-secure-d/
https://www.upstreamsystems.com/27-million-premium-subnoscription-fraud-and-invisible-ads-within-vivavideo-identified-by-secure-d/
Upstream
$27 million Premium Subnoscription Fraud and Invisible Ads within VivaVideo Identified by Secure-D - Upstream
Upstream’s mobile security platform Secure-D identified that a popular Android app was responsible for over 20 million fraudulent transaction attempts.
Vulnerable Banking Application for Android
https://github.com/rewanth1997/Damn-Vulnerable-Bank
https://github.com/rewanth1997/Damn-Vulnerable-Bank
GitHub
GitHub - rewanthtammana/Damn-Vulnerable-Bank: Damn Vulnerable Bank is designed to be an intentionally vulnerable android application.…
Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. This provides an interface to assess your android application security hacking skills. - rewanthtammana/Damn-...