Android app gives his phone the power to mimic credit card communications and exploit flaws in the NFC systems’ firmware can chain together multiple exploits to crash point-of-sales devices, hack them to collect and transmit card data, change the value of transactions, and even lock the devices with a ransomware message
https://www.xda-developers.com/smartphones-nfc-point-of-sale-atm-hack/
https://www.xda-developers.com/smartphones-nfc-point-of-sale-atm-hack/
XDA Developers
NFC smartphones enabled researchers to hack point of sale systems and ATMs
Smartphones with NFC enabled allowed researchers to hack point of sale systems and ATMs, gaining custom code execution on some of them.
👍1
How to setup Ninjutsu Android Penetration Testing Environment
https://ninjutsu-blog.github.io/2021/06/27/How-to-setup-Ninjutsu-Android-Penetration-Testing-Environment/
https://ninjutsu-blog.github.io/2021/06/27/How-to-setup-Ninjutsu-Android-Penetration-Testing-Environment/
Ninjutsu Project
How to setup Ninjutsu Android Penetration Testing Environment
Ninjutsu Android Penetration Testing EnvironmentThis is a portable android Penetration testing environment that includes specific tools to help you to conduct android applications. List of Tools insta
Android trojans steal Facebook users’ logins and passwords
https://news.drweb.com/show/?i=14244&lng=en&c=5
https://news.drweb.com/show/?i=14244&lng=en&c=5
Dr.Web
Android trojans steal Facebook users’ logins and passwords
Doctor Web’s malware analysts have discovered malicious apps on Google Play that steal Facebook users’ logins and passwords. These stealer trojans were spread as harmless software and were installed more than 5,856,010 times.
Reverse Engineering the M6 Smart Fitness Bracelet
https://rbaron.net/blog/2021/07/06/Reverse-engineering-the-M6-smart-fitness-band.html
https://rbaron.net/blog/2021/07/06/Reverse-engineering-the-M6-smart-fitness-band.html
rbaron.net
Reverse Engineering the M6 Smart Fitness Bracelet
A blog post on hacking the $6 M6 fitness tracker.
Android Crypto Mining Scams - fake apps provide fake cloud cryptocurrency mining
https://blog.lookout.com/lookout-unearths-android-crypto-mining-scams
https://blog.lookout.com/lookout-unearths-android-crypto-mining-scams
👍1
Damn Vulnerable Bank - vulnerable Android application that tests your Android hacking skills
https://rewanthtammana.com/damn-vulnerable-bank/index.html
https://rewanthtammana.com/damn-vulnerable-bank/index.html
Vulnerability in Xiaomi MIUI Powerkeeper App allows an attacker on the same network to write arbitrary files on the device, as the system user
https://bugs.chromium.org/p/apvi/issues/detail?id=50
https://bugs.chromium.org/p/apvi/issues/detail?id=50
Washing Machine app won't work unless I give it access to my contacts, location and camera.
https://www.reddit.com/r/assholedesign/comments/offnc8/my_washing_machine_app_wont_work_unless_i_give_it/
https://www.reddit.com/r/assholedesign/comments/offnc8/my_washing_machine_app_wont_work_unless_i_give_it/
Reddit
From the assholedesign community on Reddit: My Washing Machine app won't work unless I give it access to my contacts, location…
Explore this post and more from the assholedesign community
Investigating Android malware with Pithus
https://cryptax.medium.com/investigating-android-malware-with-pithus-17d2143cc528
https://cryptax.medium.com/investigating-android-malware-with-pithus-17d2143cc528
Medium
Investigating Android malware with Pithus
Pithus is a web front-end for several other tools: APKiD, MobSF, Quark, Androguard etc. I decided to try it against a random recent…
Creating a powerful Android app context protector with Frida and r2
https://docs.google.com/presentation/d/1BktWJ91ill5iI_-ENzh2Uq14BGIHxxpONzNYybYJIC4/edit#slide=id.p
https://docs.google.com/presentation/d/1BktWJ91ill5iI_-ENzh2Uq14BGIHxxpONzNYybYJIC4/edit#slide=id.p
Google Docs
Creating a powerful protector with frida
Creating a powerful Android app context protector With frida and r2 Giovanni - iGio90 - Rocca @Ultrapowa | @Defunct | @Bha | @Pepper | @VeronicaPabloOsorio m0lecon 2020
iOS zero-day let SolarWinds hackers compromise fully updated iPhones
https://arstechnica.com/gadgets/2021/07/solarwinds-hackers-used-an-ios-0-day-to-steal-google-and-microsoft-credentials/
https://arstechnica.com/gadgets/2021/07/solarwinds-hackers-used-an-ios-0-day-to-steal-google-and-microsoft-credentials/
Ars Technica
iOS zero-day let SolarWinds hackers compromise fully updated iPhones
Flaw was exploited when government officials clicked on links in LinkedIn messages.
Blog post about the anti-jailbreak, anti-Frida, anti-debug used in PokemonGO
https://www.romainthomas.fr/post/21-07-pokemongo-anti-frida-jailbreak-bypass/
https://www.romainthomas.fr/post/21-07-pokemongo-anti-frida-jailbreak-bypass/
Romain Thomas
Gotta Catch 'Em All: Frida & jailbreak detection | Romain Thomas
This blog post analyzes the Frida and Jailbreak detection in PokemonGO for iOS.
Meet WiFiDemon: iOS WiFi RCE 0-Day Vulnerability & a 'Zero-Click' Vulnerability That was Silently Patched
https://blog.zecops.com/research/meet-wifidemon-ios-wifi-rce-0-day-vulnerability-and-a-zero-click-vulnerability-that-was-silently-patched/
https://blog.zecops.com/research/meet-wifidemon-ios-wifi-rce-0-day-vulnerability-and-a-zero-click-vulnerability-that-was-silently-patched/
Jamf
Jamf Threat Labs | Blog
Forensic Methodology Report: How to catch NSO Group’s Pegasus
https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/
https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/
Amnesty International
Forensic Methodology Report: How to catch NSO Group’s Pegasus
NSO Group claims that its Pegasus spyware is only used to “investigate terrorism and crime” and “leaves no traces whatsoever”. This Forensic Methodology Report shows that neither of these statements are true. This report accompanies the release of the Pegasus…
Some URL shortener services distribute Android malware, including banking or SMS trojans
https://www.welivesecurity.com/2021/07/20/url-shortener-services-android-malware-banking-sms-trojans/
https://www.welivesecurity.com/2021/07/20/url-shortener-services-android-malware-banking-sms-trojans/
WeLiveSecurity
Some URL shortener services distribute Android malware, including banking or SMS trojans
On iOS we have seen link shortener services pushing spam calendar files to victims’ devices.
Forwarded from The Bug Bounty Hunter
Pentesting iOS| Starting With iOS Emulator Corellium & Re-signing IPA
https://justm0rph3u5.medium.com/pentesting-ios-starting-with-ios-emulator-corellium-re-signing-ipa-9ce3cbd19721
https://justm0rph3u5.medium.com/pentesting-ios-starting-with-ios-emulator-corellium-re-signing-ipa-9ce3cbd19721
Medium
Pentesting iOS| Starting With iOS Emulator Corellium & Re-signing IPA
Corellium provided virtual iOS-based devices for individual accounts on our groundbreaking security research platform, CORSEC. Corellium’s…
The Coper―a new Android banking trojan targeting Colombian users
https://news.drweb.com/show/?i=14259&lng=en&c=5
https://news.drweb.com/show/?i=14259&lng=en&c=5
Dr.Web
The Coper―a new Android banking trojan targeting Colombian users
Doctor Web warns of a newly discovered family of Android banking trojans dubbed Android.BankBot.Coper. The malicious apps have a modular architecture and a multi-stage infection mechanism. They also have several protective techniques helping them withstand…
StrongPity APT Group Deploys Android Malware for the First Time on the Syrian e-Gov website
https://www.trendmicro.com/en_us/research/21/g/strongpity-apt-group-deploys-android-malware-for-the-first-time.html
https://www.trendmicro.com/en_us/research/21/g/strongpity-apt-group-deploys-android-malware-for-the-first-time.html
Trend Micro
StrongPity APT Group Deploys Android Malware for the First Time
We recently conducted an investigation into a malicious Android malware sample, which we believe can be attributed to the StrongPity APT group, that was posted on the Syrian e-Gov website. To the best of our knowledge, this is the first time that the group…