Mobile App Penetration Testing Cheat Sheet
https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet
https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet
GitHub
GitHub - tanprathan/MobileApp-Pentest-Cheatsheet: The Mobile App Pentest cheat sheet was created to provide concise collection…
The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics. - tanprathan/MobileApp-Pentest-Chea...
👍27🥰1
[0x04] Reversing Shorts :: Finding and Backtracing Signal Messages on Android
https://youtu.be/oy0mn5CV-ro
https://youtu.be/oy0mn5CV-ro
YouTube
[0x04] Reversing Shorts :: Finding and Backtracing Signal Messages on Android
Tracing and backtracing works quite different on Android when compared to iOS. We'll take a look into how to list all Java classes with Frida, how to trace then, and how to generate a Java backtrace from inside the JVM. With an Android Studio virtual phone…
👍19
Discovered ad fraud scheme called - Scylla - that targeted SKDs in apps available on both Google’s Play Store and Apple’s App Store and generated over 13+ million downloads
https://www.humansecurity.com/learn/blog/poseidons-offspring-charybdis-and-scylla
https://www.humansecurity.com/learn/blog/poseidons-offspring-charybdis-and-scylla
HUMAN Security
Poseidon’s Offspring: Charybdis and Scylla - HUMAN Security
HUMAN's Satori Threat Intelligence and Research Team uncovered a network of 89 Android and iOS apps committing various flavors of ad fraud.
👍7🔥2
Analysis of a 7-year mobile surveillance campaign targeting largest minority in China conducted by Scarlet Mimic hacking group
https://blog.checkpoint.com/2022/09/22/cpr-analyzes-a-7-year-mobile-surveillance-campaign-targeting-largest-minority-in-china/
https://blog.checkpoint.com/2022/09/22/cpr-analyzes-a-7-year-mobile-surveillance-campaign-targeting-largest-minority-in-china/
Check Point Blog
CPR analyzes A 7-year mobile surveillance campaign targeting largest minority in China - Check Point Blog
Highlights: Check Point Research (CPR) examines a long running mobile surveillance campaign, targeting the largest minority in China- the Uyghurs. The
👍7
Technical analysis of Alien Android malware
https://muha2xmad.github.io/malware-analysis/alien/
https://muha2xmad.github.io/malware-analysis/alien/
muha2xmad
Technical analysis of Alien android malware
بسم الله الرحمن الرحيم
👍11❤3
Harly: another Trojan subscriber on Google Play
https://www.kaspersky.com/blog/harly-trojan-subscriber/45573/
https://www.kaspersky.com/blog/harly-trojan-subscriber/45573/
Kaspersky
The Harly Trojan subscriber in Google Play apps
A slew of apps containing the Harly Trojan subscriber have been found on Google Play, adding up to more than 4.8 million downloads. We explain why these apps are dangerous.
👍10❤1
Mitigate security risks in your Android app
https://developer.android.com/topic/security/risks
https://developer.android.com/topic/security/risks
Android Developers
Mitigate security risks in your app | App quality | Android Developers
👍20
A Technical Analysis of Pegasus for Android – Part 2
https://cybergeeks.tech/a-technical-analysis-of-pegasus-for-android-part-2/
https://cybergeeks.tech/a-technical-analysis-of-pegasus-for-android-part-2/
👍26🔥5
Heap buffer overflow in Android 12 Can Cause Chrome Sandbox Escape to system privilege
https://bugs.chromium.org/p/chromium/issues/detail?id=1283640
https://bugs.chromium.org/p/chromium/issues/detail?id=1283640
👍18
Analyze iOS kernel with free tools
youtu.be/HReVZH9fMcc
youtu.be/HReVZH9fMcc
YouTube
[0x05] Reversing Shorts :: iOS Kernel Demystified
The XNU kernel is essential to iOS and macOS security. In this video, we'll take a look into Apple's open-source releases as well as free tools to analyze closed-source extensions.
Full playlist of reversing shorts: https://www.youtube.com/playlist?list…
Full playlist of reversing shorts: https://www.youtube.com/playlist?list…
👍13🕊5
New Pegasus Spyware Abuses Identified in Mexico
https://citizenlab.ca/2022/10/new-pegasus-spyware-abuses-identified-in-mexico/
https://citizenlab.ca/2022/10/new-pegasus-spyware-abuses-identified-in-mexico/
The Citizen Lab
New Pegasus Spyware Abuses Identified in Mexico
Mexican digital rights organization R3D, with technical support from the Citizen Lab, has determined that Mexican journalists and a human rights defender were infected with Pegasus between 2019 and 2021. The infections occurred years after the first revelations…
👍18🔥3❤1😁1🎉1
Pixel6: Booting up
https://eshard.com/posts/pixel6_bootloader
https://eshard.com/posts/pixel6_bootloader
👍15
Analysis of the Pixel 6 bootloader: Emulation, ROP
https://eshard.com/posts/pixel6bootloader-2
https://eshard.com/posts/pixel6bootloader-2
👍16
RatMilad - New Android Spyware impersonating virtual phone numbers
https://blog.zimperium.com/we-smell-a-ratmilad-mobile-spyware/
https://blog.zimperium.com/we-smell-a-ratmilad-mobile-spyware/
👍8🔥8
Meta identified more than 400 malicious Android and iOS apps that steal Facebook login information #FaceStealer
https://about.fb.com/news/2022/10/protecting-people-from-malicious-account-compromise-apps/
https://about.fb.com/news/2022/10/protecting-people-from-malicious-account-compromise-apps/
Meta Newsroom
Protecting People From Malicious Account Compromise Apps
More than 400 malicious Android and iOS apps this year targeted people to steal their Facebook login information.
👍13🥰6👏1
Fuzzing Host-to Guest Attack Surface in Android Protected KVM
https://youtu.be/cJjjlSG6JEA
https://youtu.be/cJjjlSG6JEA
YouTube
Fuzzing Host-to Guest Attack Surface in Android Protected KVM- Eugene Rodionov & Will Deacon, Google
Fuzzing Host-to Guest Attack Surface in Android Protected KVM - Eugene Rodionov & Will Deacon, Google
Android 13 introduces native support of virtualization services built on top of Protected KVM (pKVM) for arm64 devices. Unlike in traditional KVM where…
Android 13 introduces native support of virtualization services built on top of Protected KVM (pKVM) for arm64 devices. Unlike in traditional KVM where…
👍14👎1
Malicious WhatsApp mod distributed through legitimate apps such as Vidmate and Snaptube
https://securelist.com/malicious-whatsapp-mod-distributed-through-legitimate-apps/107690/
https://securelist.com/malicious-whatsapp-mod-distributed-through-legitimate-apps/107690/
Securelist
Malicious WhatsApp mod distributed through legitimate apps
The malicious version of YoWhatsApp messenger, containing Triada trojan, was spreading through ads in the popular Snaptube app and the Vidmate app's internal store.
👍15
Forwarded from The Bug Bounty Hunter
MOBILE PENTESTING 101 – BYPASSING BIOMETRIC AUTHENTICATION
https://securitycafe.ro/2022/09/05/mobile-pentesting-101-bypassing-biometric-authentication/
https://securitycafe.ro/2022/09/05/mobile-pentesting-101-bypassing-biometric-authentication/
Security Café
Mobile Pentesting 101 – Bypassing Biometric Authentication
Android and iOS Fingerprint bypassing techniques. The article presents multiple biometric bypass methods, including Frida and objection.
👍17
TOAD attacks: Vishing combined with Android banking malware now targeting Italian banks
https://www.threatfabric.com/blogs/toad-fraud.html
https://www.threatfabric.com/blogs/toad-fraud.html
ThreatFabric
TOAD attacks: Vishing combined with Android banking malware now targeting Italian banks
ThreatFabric’s analysts uncovered a network of phishing websites targeting Italian online-banking users and aiming to steal their banking credentials.
👍15
Forwarded from The Bug Bounty Hunter
Meta iOS Hacking talk from BountyCon by @phwd_
https://docs.google.com/presentation/d/1PPsyLhTxMAk1IyIp6p5ls0dhnqm3xVQKb8rE9z-N548/
https://docs.google.com/presentation/d/1PPsyLhTxMAk1IyIp6p5ls0dhnqm3xVQKb8rE9z-N548/
Google Docs
Meta iOS Hunting
👍16❤2