Mobile MitM: Intercepting your Android App Traffic On the Go

https://www.eff.org/deeplinks/2022/04/mobile-mitm-intercepting-your-android-app-traffic-go

A Year in Review of 0-days Used In-the-Wild in 2021 by Google
In 2021 there were 7 #Android in-the-wild 0-days detected and disclosed:
- Qualcomm Adreno GPU driver (CVE-2020-11261, CVE-2021-1905, CVE-2021-1906)
- ARM Mali GPU driver (CVE-2021-28663, CVE-2021-28664)
- Upstream Linux kernel (CVE-2021-1048, CVE-2021-0920)

For the 5 total #iOS and macOS in-the-wild 0-days, they targeted 3 different attack surfaces:
- IOMobileFrameBuffer (CVE-2021-30807, CVE-2021-30883)
- XNU Kernel (CVE-2021-1782 & CVE-2021-30869)
- CoreGraphics (CVE-2021-30860)
- CommCenter (FORCEDENTRY sandbox escape - CVE requested, not yet assigned)
https://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-know-you.html

RCE vulnerability found in Qualcomm/MediaTek chips would allow attacker to gain control over a user's multimedia data, including streaming from a compromised machine's camera (CVE-2021-0674, CVE-2021-0675, CVE-2021-30351)

Exploitation: A threat actor could have sent a song (media file) and when played by a potential victim, it could have injected code in the privileged media service. The threat actor could have seen what the mobile phone user sees on their phone.
https://blog.checkpoint.com/2022/04/21/largest-mobile-chipset-manufacturers-used-vulnerable-audio-decoder-2-3-of-android-users-privacy-around-the-world-were-at-risk/

Android Bianlian Botnet (AKA Hydra) Trying to Bypass Photo TAN Used for Mobile Banking
https://www.fortinet.com/blog/threat-research/android-bianlian-botnet-mobile-banking

Google Play developers must declare what data their software collects from users of their app.
(Developers can begin declaring how collected data is used starting today, with the deadline to complete their submissions being July 20th, 2022) https://www.bleepingcomputer.com/news/security/google-play-store-now-forces-apps-to-disclose-what-data-is-collected/

PoC kernel r/w exploit for iOS 15.0 - 15.1.1 that was patched in iOS 15.2 (CVE-2021-30937) https://github.com/potmdehex/multicast_bytecopy

In 2021 Google blocked 1.2 million policy violating apps from being published on Google Play
- banned 190k malicious and spammy developer accounts in 2021
- closed around 500k developer accounts that are inactive or abandoned
https://security.googleblog.com/2022/04/how-we-fought-bad-apps-and-developers.html

Reverse engineering and analysis of a Android fiscal printer
https://www.shielder.com/blog/2022/04/printing-fake-fiscal-receipts-an-italian-job-p.1/

Android 13 adds a security feature that BLOCKS users from enabling accessibility services for apps they sideloaded outside of an app store. This is designed to combat banking trojans and spyware that misuse Accessibility APIs
https://blog.esper.io/android-13-sideloading-restriction-harder-malware-abuse-accessibility-apis/

NetHunter Wi-Fi packet capturing on Android and Rubber Ducky running on smartwatches mobile combo
https://youtube.com/shorts/mepZZu78hSI

Instagram Credentials Stealer: Disguised as Mod App
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/instagram-credentials-stealer-disguised-as-mod-app/

Instagram Credentials Stealers: Free Followers or Free Likes
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/instagram-credentials-stealers-free-followers-or-free-likes/

NahamCon CTF 2022 Write-up: Click Me! Android challenge
https://infosecwriteups.com/nahamcon-ctf-2022-write-up-click-me-android-challenge-63ccba7cb663

Mobile-Related Threats by Avast for Q1/2022 (Adware, Bankers, PremiumSMS, Ransomware)
https://decoded.avast.io/threatresearch/avast-q1-2022-threat-report/

Samsung Flow - Any App Can Read The External Storage CVE-2022-28775
A rogue application could use this issue to read contents on the device's external storage without requiring the proper Android permissions
https://labs.f-secure.com/advisories/samsung-flow-any-app-can-read-the-external-storage/

Samsung Galaxy - Any App Can Install Any App In The Galaxy App Store CVE-2022-28776
This new intent received by the Galaxy App Store could be manipulated in such a way that the Galaxy App Store would be forced to automatically install other applications onto the victim's device without consent
https://labs.f-secure.com/advisories/samsung-galaxy-any-app-can-install-any-app/

Warning: GRIM and Magnus Android Botnets are Underground
https://www.fortinet.com/blog/threat-research/grim-magnus-android-botnets

Mobile subnoscription Trojans and their little tricks
https://securelist.com/mobile-subnoscription-trojans-and-their-tricks/106412/

The noscript to install important Android Pentesting tools & configure genymotion emulator automatically with tools
https://xenion0.github.io/xenion/posts/Android-install/

Reversing an Android sample which uses Flutter
https://cryptax.medium.com/reversing-an-android-sample-which-uses-flutter-23c3ff04b847

Google Play Store App with 10,000+ Served Android Teabot/Anatsa Banking Trojan
https://labs.k7computing.com/index.php/play-store-app-serves-teabot-via-github/