VivaVideo Android app is responsible for unwanted premium subnoscription fraud and invisible ads
https://www.upstreamsystems.com/27-million-premium-subnoscription-fraud-and-invisible-ads-within-vivavideo-identified-by-secure-d/
https://www.upstreamsystems.com/27-million-premium-subnoscription-fraud-and-invisible-ads-within-vivavideo-identified-by-secure-d/
Upstream
$27 million Premium Subnoscription Fraud and Invisible Ads within VivaVideo Identified by Secure-D - Upstream
Upstream’s mobile security platform Secure-D identified that a popular Android app was responsible for over 20 million fraudulent transaction attempts.
Vulnerable Banking Application for Android
https://github.com/rewanth1997/Damn-Vulnerable-Bank
https://github.com/rewanth1997/Damn-Vulnerable-Bank
GitHub
GitHub - rewanthtammana/Damn-Vulnerable-Bank: Damn Vulnerable Bank is designed to be an intentionally vulnerable android application.…
Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. This provides an interface to assess your android application security hacking skills. - rewanthtammana/Damn-...
Evernote: Universal-XSS, theft of all cookies from all sites, and more
https://blog.oversecured.com/Evernote-Universal-XSS-theft-of-all-cookies-from-all-sites-and-more/
https://blog.oversecured.com/Evernote-Universal-XSS-theft-of-all-cookies-from-all-sites-and-more/
Remotely stealing cookies from Firefox for Android by visiting an exploit website (CVE-2020-15647)
PoC: https://gist.github.com/kanytu/7fe0640c87b0f3e57bda51e784a7255d
Research: https://medium.com/bugbountywriteup/firefox-and-how-a-website-could-steal-all-of-your-cookies-581fe4648e8d
PoC: https://gist.github.com/kanytu/7fe0640c87b0f3e57bda51e784a7255d
Research: https://medium.com/bugbountywriteup/firefox-and-how-a-website-could-steal-all-of-your-cookies-581fe4648e8d
Gist
CVE-2020-15647 PoC
CVE-2020-15647 PoC. GitHub Gist: instantly share code, notes, and snippets.
Unpatched vulnerability found in GO SMS Pro app allows unauthorized users to see shared media attachments
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/go-sms-pro-vulnerable-to-media-file-theft/
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/go-sms-pro-vulnerable-to-media-file-theft/
Running code in the context of iOS Kernel: Part I + LPE POC on iOS 13.7
https://blog.zecops.com/vulnerabilities/running-code-in-the-context-of-ios-kernel-part-i-lpe-poc-on-ios-13-7/
https://blog.zecops.com/vulnerabilities/running-code-in-the-context-of-ios-kernel-part-i-lpe-poc-on-ios-13-7/
Mobile threat evolution Q3 2020
https://securelist.com/it-threat-evolution-q3-2020-mobile-statistics/99461/
https://securelist.com/it-threat-evolution-q3-2020-mobile-statistics/99461/
Securelist
IT threat evolution Q3 2020 Mobile statistics
The statistics presented here draw on detection verdicts returned by Kaspersky products and received from users who consented to providing statistical data. Quarterly figures According to Kaspersky Security Network, the third quarter saw: 1,189 797 detected…
Vulnerability found in Facebook Messenger for Android that causes audio call to connect before callee has answered the call (bounty $60,000)
https://bugs.chromium.org/p/project-zero/issues/detail?id=2098&s=03
https://bugs.chromium.org/p/project-zero/issues/detail?id=2098&s=03
More than 20 fake Minecraft mods discovered on Google Play (adware)
https://www.kaspersky.com/blog/minecraft-mod-adware-google-play/37717/
https://www.kaspersky.com/blog/minecraft-mod-adware-google-play/37717/
Kaspersky
Malware disguised as Minecraft mods on Google Play
More than 20 apps on Google Play that promised cool Minecraft mods turned out to be malicious.
Enter WAPDropper – Subscribe Users To Premium Services By Telecom Companies
https://research.checkpoint.com/2020/enter-wapdropper-subscribe-users-to-premium-services-by-telecom-companies/
https://research.checkpoint.com/2020/enter-wapdropper-subscribe-users-to-premium-services-by-telecom-companies/
Check Point Research
Enter WAPDropper – An Android Malware Subscribing Victims To Premium Services By Telecom Companies - Check Point Research
Research by: Aviran Hazum, Danil Golubenko, Ohad Mana Overview Check Point researchers recently encountered WAPDropper, a new malware which downloads and executes an additional payload. In the current campaign, it drops a WAP premium dialer which subscribes…
Noia: Simple Android and iOS (newly added feature) application sandbox file browser tool #Frida
https://github.com/0x742/noia
https://github.com/0x742/noia
GitHub
GitHub - 0x742/noia: [WIP] Simple mobile applications sandbox file browser tool. Powered with [frida.re](https://www.frida.re).
[WIP] Simple mobile applications sandbox file browser tool. Powered with [frida.re](https://www.frida.re). - 0x742/noia
This media is not supported in your browser
VIEW IN TELEGRAM
Run Hydra on Android to bruteforce passwords in Termux
How to crack a password of HTTP, SSH, VNC services using Hydra
Full video: https://www.instagram.com/tv/CIN7bDFghz9/
How to crack a password of HTTP, SSH, VNC services using Hydra
Full video: https://www.instagram.com/tv/CIN7bDFghz9/
iOS 1-day hunting: uncovering and exploiting CVE-2020-27950 kernel memory leak
https://www.synacktiv.com/publications/ios-1-day-hunting-uncovering-and-exploiting-cve-2020-27950-kernel-memory-leak.html
https://www.synacktiv.com/publications/ios-1-day-hunting-uncovering-and-exploiting-cve-2020-27950-kernel-memory-leak.html
Synacktiv
iOS 1-day hunting: uncovering and exploiting CVE-2020-27950 kernel
Android AdFraud found on Google Play Store
Within the interval of several seconds it loads list of websites inside the invisible WebView
https://vms.drweb.com/virus/?i=22891890
Within the interval of several seconds it loads list of websites inside the invisible WebView
https://vms.drweb.com/virus/?i=22891890
Dr.Web
Android.Mixi.44.origin — Dr.Web Malware denoscription library
A malicious program which main purpose is to open web links as well as to load and display websites on-top of other apps windows. It was originally found in the app called Eye Care - Your close Eye Care Assistant (its another name is Eye Care Mini —— 急速护眼)…
Google discovered iOS zero-click Wi-Fi wormable exploit
Remotely triggered an unauthenticated kernel memory corruption vulnerability which causes all iOS devices in radio-proximity to reboot, with no user interaction.
Exploiting this vulnerability it is possible to run arbitrary code on any nearby iOS device and steal all the user data.
This security issue is fixed now.
https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html
Remotely triggered an unauthenticated kernel memory corruption vulnerability which causes all iOS devices in radio-proximity to reboot, with no user interaction.
Exploiting this vulnerability it is possible to run arbitrary code on any nearby iOS device and steal all the user data.
This security issue is fixed now.
https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html
Blogspot
An iOS zero-click radio proximity exploit odyssey
Posted by Ian Beer, Project Zero NOTE: This specific issue was fixed before the launch of Privacy-Preserving Contact Tracing in iOS 13.5 in...
Vulnerability in Google Play Core Library Remains Unpatched in Google Play Applications
If an attacker uses file traversal, the payload is written to the verified folder, and is automatically loaded into the vulnerable application and executed within its scope.
https://research.checkpoint.com/2020/vulnerability-in-google-play-core-library-remains-unpatched-in-google-play-applications/
If an attacker uses file traversal, the payload is written to the verified folder, and is automatically loaded into the vulnerable application and executed within its scope.
https://research.checkpoint.com/2020/vulnerability-in-google-play-core-library-remains-unpatched-in-google-play-applications/
Check Point Research
Vulnerability in Google Play Core Library Remains Unpatched in Google Play Applications - Check Point Research
Research by: Aviran Hazum, Jonathan Shimonovich Overview: A new vulnerability for the Google Play Core Library was published in late August, which allows Local-Code-Execution (LCE) within the scope of any application that has the vulnerable version of the…
👍1
The Facebook Messenger Leaking Access Token Of Million Users to third party site
https://medium.com/bugbountywriteup/how-i-found-the-facebook-messenger-leaking-access-token-of-million-users-8ee4b3f1e5e3
https://medium.com/bugbountywriteup/how-i-found-the-facebook-messenger-leaking-access-token-of-million-users-8ee4b3f1e5e3
Medium
How I Found The Facebook Messenger Leaking Access Token Of Million Users
Hi everyone,
ASLR & the iOS Kernel — How virtual address spaces are randomised
https://bellis1000.medium.com/aslr-the-ios-kernel-how-virtual-address-spaces-are-randomised-d76d14dc7ebb
https://bellis1000.medium.com/aslr-the-ios-kernel-how-virtual-address-spaces-are-randomised-d76d14dc7ebb
Medium
ASLR & the iOS Kernel — How virtual address spaces are randomised
In this blog post I wanted to take a look at ASLR and how the iOS kernel implements it for user-space processes.
Deep Dive into an Obfuscation-as-a-Service for Android Malware
https://www.stratosphereips.org/blog/2020/12/03/deep-dive-into-an-obfuscation-as-a-service-for-android-malware
https://www.stratosphereips.org/blog/2020/12/03/deep-dive-into-an-obfuscation-as-a-service-for-android-malware
Stratosphere Laboratory
Deep Dive into an Obfuscation-as-a-Service for Android Malware — Stratosphere Laboratory
While confined in our homes studying the interactions of individuals involved in the spread of the Android banking Trojan botnet (known as Geost), we encountered a unique opportunity: investigate an automated obfuscation-as-a-service platform for Android…