Reverse Engineering Android React Native application
https://secureitmania.medium.com/lets-know-how-i-have-explored-the-buried-secrets-in-react-native-application-6236728198f7
https://secureitmania.medium.com/lets-know-how-i-have-explored-the-buried-secrets-in-react-native-application-6236728198f7
Medium
Let’s know How I have explored the buried secrets in React Native application
A new era in Android Reverse Engineering part-1
Vulnerability in Shazam application allowed an attacker to steal location of a user by clicking a link
https://www.ash-king.co.uk/blog/Shazlocate-abusing-CVE-2019-8791-CVE-2019-8792
https://www.ash-king.co.uk/blog/Shazlocate-abusing-CVE-2019-8791-CVE-2019-8792
www.ash-king.co.uk
ShazLocate!
Abusing CVE-2019-8791 & CVE-2019-8792
Abusing CVE-2019-8791 & CVE-2019-8792
Stealing location data with a single click via Shazam
How to gain access to arbitrary Content Providers
https://blog.oversecured.com/Gaining-access-to-arbitrary-Content-Providers/
https://blog.oversecured.com/Gaining-access-to-arbitrary-Content-Providers/
News, Techniques & Guides
Gaining access to arbitrary* Content Providers
The vulnerability we shall be looking at is very common, but remains little known. We want to shed some light on it today, so as to help app developers avoid it when they write their apps and security researchers find it in other people's apps and warn the…
A Special Attack Surface of the Android System (1): Evil Dialog Box
https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1351377961017942016
https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1351377961017942016
Blowing the Cover of Android Binary Fuzzing
https://speakerdeck.com/flankerhqd/blowing-the-cover-of-android-binary-fuzzing
https://speakerdeck.com/flankerhqd/blowing-the-cover-of-android-binary-fuzzing
MobileAudit - performs security testing and malware analysis for Android APKs
https://github.com/mpast/mobileAudit
https://github.com/mpast/mobileAudit
GitHub
GitHub - mpast/mobileAudit: Django application that performs SAST and Malware Analysis for Android APKs
Django application that performs SAST and Malware Analysis for Android APKs - mpast/mobileAudit
Analysis of Android Worm that spreads via WhatsApp messages as Huawei Mobile app
https://youtu.be/XXi29noe2NE
https://youtu.be/XXi29noe2NE
Different Android security lock states and their trade-offs
https://www.mayrhofer.eu.org/post/android-tradeoffs-2-lockstates/
https://www.mayrhofer.eu.org/post/android-tradeoffs-2-lockstates/
René Mayrhofer
Android security trade-offs 2: Lock states | René Mayrhofer
Android has different types of lock states. This post summarizes what they are, what their purpose is, and how the interact.
Update your iOS!
iOS 0days chain /RCE+LPE/ is being exploited ITW. The fix is available.
https://support.apple.com/en-us/HT212146
iOS 0days chain /RCE+LPE/ is being exploited ITW. The fix is available.
https://support.apple.com/en-us/HT212146
Apple Support
About the security content of iOS 14.4 and iPadOS 14.4
This document describes the security content of iOS 14.4 and iPadOS 14.4.
Apparently new Android banking Trojan called "Oscorp" spreads in Italy
http://translate.google.com/translate?hl=en&sl=auto&tl=en&u=https%3A%2F%2Fcert-agid.gov.it%2Fnews%2Foscorp-il-solito-malware-per-android%2F
http://translate.google.com/translate?hl=en&sl=auto&tl=en&u=https%3A%2F%2Fcert-agid.gov.it%2Fnews%2Foscorp-il-solito-malware-per-android%2F
Demo of technique used by Android malware that prevents victim to uninstall it from device (how to fix it)
https://youtu.be/YvfiKPpMoaU
https://youtu.be/YvfiKPpMoaU
Useful insight on Android's Special App Accesses, since they are treated and mitigated differently as regular app permissions
https://medium.com/mitre-attack/mobile-attack-mitigating-android-abuse-50516fb7de85
https://medium.com/mitre-attack/mobile-attack-mitigating-android-abuse-50516fb7de85
Medium
Mitigating Abuse of Android Application Permissions and Special App Accesses
Part 1 of a series on ATT&CK® for Mobile (Android and iOS) devices
Security Fixes and Rewards for Chrome for Android
https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
Chrome Releases
Chrome for Android Update
Hi, everyone! We've just released Chrome 86 (86.0.4240.99) for Android: it'll become available on Google Play over the next few weeks. Thi...
👍2
Investigation Xoth: Smartphone location tracking
https://www.expressvpn.com/digital-security-lab/investigation-xoth
https://www.expressvpn.com/digital-security-lab/investigation-xoth
ExpressVPN
ExpressVPN’s Research on Smartphone Location Tracking | ExpressVPN
Investigation Xoth is the ExpressVPN Digital Security Lab’s research into smartphone location tracking. Read about its findings here.
Reverse Engineering iMessage: Leveraging the Hardware to Protect the Software
https://www.nowsecure.com/blog/2021/01/27/reverse-engineering-imessage-leveraging-the-hardware-to-protect-the-software/
https://www.nowsecure.com/blog/2021/01/27/reverse-engineering-imessage-leveraging-the-hardware-to-protect-the-software/
Nowsecure
Reverse Engineering iMessage to Help Improve Security | NowSecure
Our researcher reverse engineered Apple iMessage to explore extending it the secure messaging app to other systems. See how he fared.
Forwarded from The Bug Bounty Hunter
Android Penetration Testing: Frida https://www.hackingarticles.in/android-penetration-testing-frida/
Hacking Articles
Android Penetration Testing: Frida
Learn how to use Frida for Android penetration testing, including hooking, injecting, and analyzing Android apps for security vulnerabilities.
❤1
Vulnerability found in Facebook for Android that could trigger malicious deep links, run arbitrary JavaScript or replace URLs to phishing pages
https://ash-king.co.uk/blog/Launching-internal-non-exported-deeplinks-on-Facebook
https://ash-king.co.uk/blog/Launching-internal-non-exported-deeplinks-on-Facebook
ash-king.co.uk
Launching internal & non-exported deeplinks on Facebook
Ash King - Software Developer & Security Researcher
👍1
Reverse engineering Flutter for Android + Doldrums (Doldrums is a reverse engineering tool for Flutter apps)
https://rloura.wordpress.com/2020/12/04/reversing-flutter-for-android-wip/
https://github.com/rscloura/Doldrums
https://rloura.wordpress.com/2020/12/04/reversing-flutter-for-android-wip/
https://github.com/rscloura/Doldrums
A Moment of Insanity
Reverse engineering Flutter for Android
Disclaimer: the contents of this article are the result of countless hours of personal investigation combined with exhaustive trial and error. I have never contacted Flutter or Dart development tea…
Dissecting a MediaTek BootROM exploit
https://tinyhack.com/2021/01/31/dissecting-a-mediatek-bootrom-exploit/
https://tinyhack.com/2021/01/31/dissecting-a-mediatek-bootrom-exploit/
Tinyhack.com
Dissecting a MediaTek BootROM exploit
A bricked Xiaomi phone led me to discover a project in Github that uses a MediaTek BootROM exploit that was undocumented. The exploit was found by Xyz, and implemented by Chaosmaster. The initial exploit was already available for quite a while. Since I have…
Data Driven Security Hardening in Android
https://security.googleblog.com/2021/01/data-driven-security-hardening-in.html
https://security.googleblog.com/2021/01/data-driven-security-hardening-in.html
Google Online Security Blog
Data Driven Security Hardening in Android
Posted by Kevin Deus, Joel Galenson, Billy Lau and Ivan Lozano, Android Security & Privacy Team The Android platform team is committed to ...
Hackers tried to trick iPhone users into installing a fake version of WhatsApp to spy on them.
How: By tricking users into installing configuration files or so-called Mobile Device Management (MDM) profiles, which can then potentially push malware onto a target device.
https://www.vice.com/en/article/akdqwa/a-spyware-vendor-seemingly-made-a-fake-whatsapp-to-hack-targets
How: By tricking users into installing configuration files or so-called Mobile Device Management (MDM) profiles, which can then potentially push malware onto a target device.
https://www.vice.com/en/article/akdqwa/a-spyware-vendor-seemingly-made-a-fake-whatsapp-to-hack-targets
VICE
A Spyware Vendor Seemingly Made a Fake WhatsApp to Hack Targets
Technical analyses by Citizen Lab and Motherboard found links between a fake version of WhatsApp and Cy4Gate, an Italian surveillance firm that works with cops and intelligence agencies.