If Bluetooth is ON on your Apple device everyone nearby can sniff your mobile phone number. [Video demo included]
https://hexway.io/blog/apple-bleee/
PoCs: https://github.com/hexway/apple_bleee

Five bugs in iMessages

1) CVE-2019-8647 is a remote, interactionless use-after-free - https://bugs.chromium.org/p/project-zero/issues/detail?id=1873

2) CVE-2019-8662 - https://bugs.chromium.org/p/project-zero/issues/detail?id=1917

3) CVE-2019-8660 is remote, interactionless memory corruption - https://bugs.chromium.org/p/project-zero/issues/detail?id=1884

4) CVE-2019-8646 allows an attacker to read files off a remote device with no user interaction, as user mobile with no sandbox - https://bugs.chromium.org/p/project-zero/issues/detail?id=1858

5) Out-of-bounds read in DigitalTouch tap message processing - https://bugs.chromium.org/p/project-zero/issues/detail?id=1828

Such vulnerabilities, when sold on the black market, can bring a bug hunter well over $1 million, according to a price chart published by Zerodium.
https://www.zdnet.com/article/google-researchers-disclose-exploits-for-interactionless-ios-attacks/

Mobile Threat Landscape Report 2019

A comprehensive review of mobile malware trend

Update your Truecaller app

The bug led the Truecaller app to quietly send a text message to a bank to verify their account — which is part of the procedure to sign up to the payments service.
https://techcrunch.com/2019/07/30/truecaller-upi-payments-bug/

Mobile Security Review 2019

Google Play Protect had the worst malware scan results.

"Android includes built-in security features for malware detection, device loss or theft, and safe browsing for free. However, Play Protect does not yet provide effective protection." @AV_Comparatives
https://www.av-comparatives.org/tests/mobile-security-review-2019/

Facebook & WhatsApp will send to their cloud all users messages in clear text before encryption. #privacy

"If the company’s new on-device content moderation succeeds it will usher in the end of consumer end-to-end encryption and create a framework for governments to outsource their mass surveillance directly to social media companies, completely bypassing encryption."
https://www.forbes.com/sites/kalevleetaru/2019/07/26/the-encryption-debate-is-over-dead-at-the-hands-of-facebook/

Mobile forensics are analyzing the smartphone itself with possible access to cloud data. However, extending the search to the user’s desktop and laptop computers may (and possibly will) help accessing information stored both in the physical smartphone and in the cloud.
https://blog.elcomsoft.com/2019/07/extended-mobile-forensics-analyzing-desktop-computers/

HiddenAd Adware with 500,000 installs found on Google Play
https://twitter.com/ESETresearch/status/1156551255701020672?s=19

AdFraud app found on Google Play had 1,000,000+ installs
https://twitter.com/ESETresearch/status/1156587825812271106?s=19

Remotely Stole Files Through iMessage on iOS 12.3.1 (CVE-2019-8646 by natashenka)
https://youtu.be/ld2m0CPR1nM

Review of harmful apps on Google Play in July 2019

All these apps and numbers are based on researches, blogs, reports, tweets published in July, 2019 by #infosec community.

Opera Android Address Bar Spoofing: CVE-2019–12278
https://medium.com/@justm0rph3u5/opera-android-address-bar-spoofing-cve-2019-12278-9ffcfd6c508c

America Phone Farmers

Ordinary Americans are using armies of phones to generate cash through ad fraud.
https://www.vice.com/en_us/article/d3naek/how-to-make-a-phone-farm

Tested 21 Android antivirus apps and found serious vulnerabilities

-3 IDOR vulnerabilities (leak address book, send fake alerts, remotely disabling AV protection)
-2 XSS
https://www.comparitech.com/antivirus/android-antivirus-vulnerabilities/

Top Android malware threats - Month of July, 2019

Full list: http://skptr.me/malware_timeline_2019.html
Download samples: https://github.com/sk3ptre/AndroidMalware_2019

Fake Antivirus with 100K+ installs found on Google Play
https://twitter.com/tom_sara05/status/1157176010585997312?s=19

Subnoscription scam on Google Play with 1,000,000+ downloads exploits 3-day trial, then robs you of €54.99 per week
https://twitter.com/ESETresearch/status/1157206903602028544

Three adware apps with 30,000+ installs altogether.

- in app manager they change name to Google Play Store
- hide itself icon
- display full-screen ads every 15 minutes, but only starting 24 hours after installation
https://labs.bitdefender.com/2019/07/adware-packed-fake-apps-still-making-their-way-to-google-play/

HiddenAd adware discovered on Google Play was one of the top 10 new apps in the store in July!
Reached 1M+ downloads. Reported.
https://t.co/iY3z60gicp

Record for HiddenAd Adware found on Google Play.
It reached 5,000,000+ installs.

-after launch can hide itself icon
-after unlocking device it display fullscreen ad
-reported
https://twitter.com/ReBensk/status/1157267868993515521?s=19