Xhelper: Persistent Android dropper app infects 45K devices in past 6 months
Functionality: it hide itself, can download additional apps and display ads
https://www.symantec.com/blogs/threat-intelligence/xhelper-android-malware
Functionality: it hide itself, can download additional apps and display ads
https://www.symantec.com/blogs/threat-intelligence/xhelper-android-malware
Security
Xhelper: Persistent Android Dropper App Infects 45K Devices in Past 6 Months
Malicious app hides itself, downloads other threats, displays ads, and is mainly targeting users in India, U.S., and Russia.
Analysis of Joker Trojans found on Google Play
https://labs.k7computing.com/?p=19247
https://labs.k7computing.com/?p=19247
Top Android malware threats of October, 2019
Full list: http://skptr.me/malware_timeline_2019.html
Download: - https://github.com/sk3ptre/AndroidMalware_2019
Full list: http://skptr.me/malware_timeline_2019.html
Download: - https://github.com/sk3ptre/AndroidMalware_2019
ai.type keyboard app from Google Play contained AdFraud functionality to make ad clicks and unwanted purchases
https://www.upstreamsystems.com/secure-d-uncovers-suspicious-mobile-transactions-android-keyboard-app-ai-type-generating-non-human-clicks-making-unwanted-purchases/
https://www.upstreamsystems.com/secure-d-uncovers-suspicious-mobile-transactions-android-keyboard-app-ai-type-generating-non-human-clicks-making-unwanted-purchases/
Upstream
Secure-D uncovers suspicious mobile transactions from Android Keyboard app ai.type - Upstream
Over a recent period, Upstream’s security platform Secure-D has blocked millions of suspicious mobile transaction requests coming from popular Android Emoji app ai.type.
MESSAGETAP: Tool created by APT41 (a Chinese APT group) that is designed to monitor and save SMS traffic from specific phone numbers
https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html
https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html
Google Cloud Blog
MESSAGETAP: Who's Reading Your Text Messages? | Mandiant | Google Cloud Blog
apk-mitm - tool that patches your APK to bypass certificate pinning
https://github.com/shroudedcode/apk-mitm
https://github.com/shroudedcode/apk-mitm
GitHub
GitHub - niklashigi/apk-mitm: 🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection
🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection - niklashigi/apk-mitm
1 Click Android 10 Remote Rooting via Chrome Browser by @ThomasKing2014
https://youtu.be/2pNsCi0T9MI
https://youtu.be/2pNsCi0T9MI
YouTube
1 Click Android 10 Remote Rooting DemoPixel 2XL
The App Defense Alliance: Bringing the security industry together to fight bad apps
ESET + Lookout + Zimperium will help protect apps on Google Play Store
https://security.googleblog.com/2019/11/the-app-defense-alliance-bringing.html
ESET + Lookout + Zimperium will help protect apps on Google Play Store
https://security.googleblog.com/2019/11/the-app-defense-alliance-bringing.html
Google Online Security Blog
The App Defense Alliance: Bringing the security industry together to fight bad apps
Posted by Dave Kleidermacher, VP, Android Security & Privacy Fighting against bad actors in the ecosystem is a top priority for Google, bu...
49 Disguised Adware Apps With Optimized Evasion Features Found on Google Play
https://blog.trendmicro.com/trendlabs-security-intelligence/49-disguised-adware-apps-with-optimized-evasion-features-found-on-google-play/
https://blog.trendmicro.com/trendlabs-security-intelligence/49-disguised-adware-apps-with-optimized-evasion-features-found-on-google-play/
Trend Micro
Fake Apps Read SMS Codes to Trigger WAP, Carrier Bill
We found an app named “Yellow Camera” disguised as a photo editing app. It reads SMS codes to activate a Wireless Application Protocol (WAP), targeting users in Southeast Asia but may expand as it also targets Chinese-speaking users.
Droppers downloading adware found on Google Play
https://www.wandera.com/mobile-security/dropper-apps/
https://www.wandera.com/mobile-security/dropper-apps/
Joker Trojan now uses ads on YouTube to spread
https://twitter.com/0xabc0/status/1193089908946153472?s=19
https://twitter.com/0xabc0/status/1193089908946153472?s=19
Twitter
Ahmet Bilal Can
@sh1shk0va Found the ad on youtube :(
Vulnerabilities found in Android baseband firmware could be exploited via AT commands for vulnerable devices to: get unique identifiers, such as their IMEI and IMSI numbers, downgrade a target’s connection in order to intercept phone calls, forward calls to another phone or block all phone calls and internet access altogether.
https://techcrunch.com/2019/11/08/android-baseband-flaws/
Research: https://www.documentcloud.org/documents/6543391-ATFuzzer.html
https://techcrunch.com/2019/11/08/android-baseband-flaws/
Research: https://www.documentcloud.org/documents/6543391-ATFuzzer.html
TechCrunch
Exclusive: Baseband attacks can spy on popular Android phones
The vulnerabilities affect at least ten popular Android devices, including Google's Pixel 2 and Samsung's Galaxy S8+.
How to bypass Android’s hidden API restrictions
https://www.xda-developers.com/android-development-bypass-hidden-api-restrictions/
https://www.xda-developers.com/android-development-bypass-hidden-api-restrictions/
XDA Developers
Developers: It’s super easy to bypass Android’s hidden API restrictions
Android 9 Pie and Android 10 throw warnings or outright block access to hidden APIs. Here's how developers can get around the hidden API restrictions.
Forwarded from The Bug Bounty Hunter
Configuring Frida with BurpSuite and Genymotion to bypass Android SSL Pinning
https://spenkk.github.io/bugbounty/Configuring-Frida-with-Burp-and-GenyMotion-to-bypass-SSL-Pinning/
https://spenkk.github.io/bugbounty/Configuring-Frida-with-Burp-and-GenyMotion-to-bypass-SSL-Pinning/
VirtualXposed
A simple App based on VirtualApp and epic that allows you to use an Xposed Module without needing to root, unlock the bootloader, or flash a custom system image. (Supports Android 5.0~9.0)
https://github.com/android-hacker/VirtualXposed
A simple App based on VirtualApp and epic that allows you to use an Xposed Module without needing to root, unlock the bootloader, or flash a custom system image. (Supports Android 5.0~9.0)
https://github.com/android-hacker/VirtualXposed
GitHub
GitHub - android-hacker/VirtualXposed: A simple app to use Xposed without root, unlock the bootloader or modify system image, etc.
A simple app to use Xposed without root, unlock the bootloader or modify system image, etc. - android-hacker/VirtualXposed
RCE Vulnerability found in Android
CVE-2019-2205 - memory corruption due to a use after free could lead to RCE
It was fixed in the latest Android Security Bulletin—November 2019. Update!
https://www.nowsecure.com/blog/2019/11/13/nowsecure-discovers-critical-android-vuln-that-may-lead-to-remote-code-execution/
CVE-2019-2205 - memory corruption due to a use after free could lead to RCE
It was fixed in the latest Android Security Bulletin—November 2019. Update!
https://www.nowsecure.com/blog/2019/11/13/nowsecure-discovers-critical-android-vuln-that-may-lead-to-remote-code-execution/
Nowsecure
Critical Android Vuln May Hide Remote Code Execution - NowSecure Blog
In the course of performing Android application security testing, I suspected that a library called libpac might be vulnerable to exploit. This vulnerability has been assigned CVE-2019-2205. Google deployed a fix and we recommend all users apply it to secure…
The Road to Qualcomm TrustZone Apps Fuzzing
Vulnerability allows to execute trusted apps in the Normal World (Android OS)
https://research.checkpoint.com/the-road-to-qualcomm-trustzone-apps-fuzzing/
Vulnerability allows to execute trusted apps in the Normal World (Android OS)
https://research.checkpoint.com/the-road-to-qualcomm-trustzone-apps-fuzzing/
Check Point Research
The Road to Qualcomm TrustZone Apps Fuzzing - Check Point Research
Research By: Slava Makkaveev Trusted Execution Environment TrustZone is a security extension integrated by ARM into the Corex-A processor. This extension creates an isolated virtual secure world which can be used by the main operating system running on the…
iOS sandbox escape due to integer overflow in mediaserverd
Fixed in iOS 13.2.
https://bugs.chromium.org/p/project-zero/issues/detail?id=1922
Fixed in iOS 13.2.
https://bugs.chromium.org/p/project-zero/issues/detail?id=1922
Library created to secure iOS apps in development process according to the OWASP MASVS standards.
With this library you can detect:
- Jailbreak
- being debugged
- Reverse Engineering Tools (e.g. Frida)
- Run in an emulator
https://github.com/securing/IOSSecuritySuite
With this library you can detect:
- Jailbreak
- being debugged
- Reverse Engineering Tools (e.g. Frida)
- Run in an emulator
https://github.com/securing/IOSSecuritySuite
GitHub
GitHub - securing/IOSSecuritySuite: iOS platform security & anti-tampering Swift library
iOS platform security & anti-tampering Swift library - securing/IOSSecuritySuite
Don't trust USB charging stations!
LA officials publish warning about the dangers of using public USB charging stations -- as they can hide malware
Their advice:
- use the AC charging socket, not the USB one
- bring your own USB charger from home
via @campuscodi
https://www.zdnet.com/google-amp/article/officials-warn-about-the-dangers-of-using-public-usb-charging-stations/
LA officials publish warning about the dangers of using public USB charging stations -- as they can hide malware
Their advice:
- use the AC charging socket, not the USB one
- bring your own USB charger from home
via @campuscodi
https://www.zdnet.com/google-amp/article/officials-warn-about-the-dangers-of-using-public-usb-charging-stations/
ZDNET
Officials warn about the dangers of using public USB charging stations
Travelers should use only AC charging ports, use USB no-data cables, or "USB condom" devices.