NEW BOT Телеграм, страница

Roaming Mantis implements new DNS changer in its malicious mobile app in 2022

Android malicious app gets IP of router gateway, identifies the router manufacturer, tries default credentials and changes DNS settings. Malware uses this technique to every free/public Wi-Fi networks such as cafes, bars, hotels, airports etc. so anyone connecting in these places might become a victim.
https://securelist.com/roaming-mantis-dns-changer-in-malicious-mobile-app/108464/

Securelist

Roaming Mantis implements new DNS changer in its malicious mobile app in 2022

Roaming Mantis (a.k.a Shaoye) is a long-term cyberattack campaign that uses malicious Android package (APK) files to control infected Android devices and steal data. In 2022, we observed a DNS changer function implemented in its Android malware Wroba.o.

👍13

8.11K views09:20

👍 10 👎 2

Android Security & Malware

Android Exploit to get a System based shell (UID 1000) on ANY Samsung Mobile Device based on CVE-2019-16253

1) Downgrade to vulnerable SamsungTTS app
2) Install exploit APK
3) Exploit vulnerability to achieve System rights
https://forum.xda-developers.com/t/system-shell-exploit-all-samsung-mobile-devices-no-bl-unlock-required.4543071/

XDA Forums

***LOCKED UNTIL FURTHER NOTICE*** System Shell Exploit - ALL...

***MODERATOR ANNOUNCEMENT: THREAD CLOSED***

@K0mraid3 you are hereby required to provide proper credit in your OP as follows:

Link the assigned CVE for this exploit as it mentions the author's...

👍19

8.21K views13:22

👍 27 👎 3

Android Security & Malware

VASTFLUX - sophisticated ad fraud operation takendown.
More than 1,700 apps and 120 publishers were spoofed, and the scheme ran inside apps on nearly 11 million devices.
https://www.humansecurity.com/learn/blog/traffic-signals-the-vastflux-takedown

HUMAN Security

Traffic signals: The VASTFLUX Takedown - HUMAN Security

HUMAN's Satori Threat Intelligence and Research Team uncovered and led a private takedown of a massive ad fraud operation called VASTFLUX.

👍8

7.06K views07:48

👍 7 👎 2

Android Security & Malware

Technical Advisory – Multiple Vulnerabilities in the Galaxy App Store (CVE-2023-21433, CVE-2023-21434)
CVE-2023-21433 is an improper access control that allows attackers to install any applications available on the Galaxy App Store.
CVE-2023-21434 is an improper input validation that lets attackers execute JavaScript on the target device.
https://research.nccgroup.com/2023/01/20/technical-advisory-multiple-vulnerabilities-in-the-galaxy-app-store-cve-2023-21433-cve-2023-21434/

NCC Group Research Blog

Technical Advisory – Multiple Vulnerabilities in the Galaxy App Store (CVE-2023-21433, CVE-2023-21434)

The Galaxy App Store is an alternative application store that comes pre-installed on Samsung Android devices. Several Android applications are available on both the Galaxy App Store and Google App …

👍12🔥3🤯3

7.79K views08:07

👍 13 👎 1

Android Security & Malware

Three Android Coper Banking Trojans Discovered On Google Play
https://twitter.com/Threatlabz/status/1617579712062324737

👍5

6.85K views07:42

👍 11 👎

Android Security & Malware

CVE-2022-42864: Diabolical Cookies
Proof-of-concept exploit for CVE-2022-42864, a time-of-check-time-of-use vulnerability in IOHIDFamily that was fixed in iOS 16.2 / macOS Ventura 13.1.
https://github.com/Muirey03/CVE-2022-42864

GitHub

GitHub - Muirey03/CVE-2022-42864: Proof-of-concept for the CVE-2022-42864 IOHIDFamily race condition

Proof-of-concept for the CVE-2022-42864 IOHIDFamily race condition - Muirey03/CVE-2022-42864

👍7

8.28K views08:43

👍 9 👎

Android Security & Malware

Pwning the all Google phone with a non-Google bug (CVE-2022-38181)
https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/

The GitHub Blog

Pwning the all Google phone with a non-Google bug

It turns out that the first “all Google” phone includes a non-Google bug. Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. Join me on my journey through reporting the vulnerability to the Android security team, and the exploit…

👍14🆒8🔥3