NEW BOT Телеграм, страница

Android Security & Malware

Memory corruption vulnerability in audio processing during a voice call in #WeChat app

Report includes PoC code + steps how to reproduce the bug
https://bugs.chromium.org/p/project-zero/issues/detail?id=1948

3.35K views00:52

Android Security & Malware

Researchers find that 17 of 140 major online services are vulnerable to SIM swapping attacks
https://www.zdnet.com/article/academic-research-finds-five-us-telcos-vulnerable-to-sim-swapping-attacks/

ZDNet

Academic research finds five US telcos vulnerable to SIM swapping attacks

Researchers find that 17 of 140 major online services are vulnerable to SIM swapping attacks.

3.34K views11:53

Android Security & Malware

Detect Frida for Android
https://darvincitech.wordpress.com/2019/12/23/detect-frida-for-android/

Darvin's Blog

Detect Frida for Android

Frida is a dynamic instrumentation framework and has remained as the most popular reverse engineering tool among security researchers, pentesters and even the bad actors. Frida is more robust compa…

3.32K views10:46

Android Security & Malware

Security hardening of Android native code
https://darvincitech.wordpress.com/2020/01/07/security-hardening-of-android-native-code/

Darvin's Blog

Security hardening of Android native code

This post is in-fact a continuation of my previous post on Frida detection. In this post, I will explain the mechanisms I have followed in hardening the native code written for Frida detection.Gene…

3.26K views10:54

Android Security & Malware

"Research shows that 91% of pre-installed apps do not appear in Google Play"

Privacy International and over 50 other organisations have submitted a letter asking Google to take action against exploitative pre-installed software on Android devices.
http://privacyinternational.org/advocacy/3320/open-letter-google

Privacy International

An open letter to Google

You can find the letter below. Add your voice to this campaign by signing our petition if you believe that its time Google stopped enabling exploitation.

3.19K views11:18

Android Security & Malware

Android Trojan Shopper

It can disable the Google Play Protect service, generate fake reviews, install malicious apps, show ads, and more
https://securelist.com/smartphone-shopaholic/95544/

Securelist

Smartphone shopaholic

Have you ever noticed strange reviews of Google Play apps that look totally out of place? Their creators might give it five stars, while dozens of users rate it with just one, and in some cases the reviews seem to

3.68K views11:40

Android Security & Malware

Updated House (runtime mobile application analysis toolkit) can hook functions in dynamically loaded dex/jar files
https://github.com/nccgroup/house

GitHub

GitHub - nccgroup/house: A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python.

A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python. - nccgroup/house

4.23K views11:59

Android Security & Malware

How to make your Android app network communication secure
https://infinum.com/the-capsized-eight/how-to-prepare-your-android-app-for-a-pentest

Infinum

How to Prepare Your Android App for a Pentest – Networking Edition

Android app penetration testing is a must when developing an app, especially if you deal with sensitive user information.

3.8K views00:37

Android Security & Malware

Subnoscription scams found on Google Play -
25 apps with almost 600M installs
https://news.sophos.com/en-us/2020/01/14/fleeceware-apps-persist-on-the-play-store/

Sophos News

Fleeceware apps persist on the Play Store

Fleeceware remains a problem on Google Play, where Android users still run the risk of being charged hundreds of dollars or euros for “subnoscriptions” to apps

3.48K views21:19

Android Security & Malware

All iPhones running iOS 10 or later can now be used as hardware security keys for Google accounts
https://www.zdnet.com/article/you-can-now-use-an-iphone-as-a-security-key-for-google-accounts/
Step-by-step tutorial: https://support.google.com/accounts/answer/9289445

ZDNet

You can now use an iPhone as a security key for Google accounts

All iPhones running iOS 10 or later can now be used as hardware security keys for Google accounts.

3.66K views14:52

Android Security & Malware

Seventeen Android HiddenAd Trojans Found in Google Play With Total Over 550K Downloads
https://labs.bitdefender.com/2020/01/seventeen-android-nasties-spotted-in-google-play-total-over-550k-downloads/

Bitdefender Labs

Seventeen Android Nasties Spotted in Google Play, Total Over 550K Downloads

Bitdefender researchers recently found 17 Google Play apps that, once installed,
start hiding their presence on the user’s device and constantly display
aggressive ads.

3.96K views16:00

Android Security & Malware

Android Enterprise Security Whitepaper
https://static.googleusercontent.com/media/www.android.com/en//static/2016/pdfs/enterprise/Android_Enterprise_Security_White_Paper_2019.pdf

3.83K views14:10

Android Security & Malware

Vulnerability in Android OneDrive app allowed to bypass passcode or fingerprint
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0654

3.67K views14:20

Android Security & Malware

How to develope and test secure #iOS apps + video demos #MASVS #MSTG
https://www.dropbox.com/sh/tsog4fwa3wg4rd9/AADuNKjtQNaliYSBjr28SevPa?dl=0

3.94K views16:39

Android Security & Malware

Chinese phone maker OPPO partners with #HackerOne to launch bug bounty program
https://security.oppo.com/en/

3.77K views10:06

Android Security & Malware

How to write #iOS program that allows to render arbitrary strings to the #iPhone screen by directly modifying the framebuffer pixels https://link.medium.com/REb7yRhkn3

Medium

Exploring the iOS screen framebuffer– a kernel reversing experiment

It’s been over two years since I last published a blog, so I thought I’d give this another go in 2020 and kick it off by writing about an…

4.42K views12:09

Android Security & Malware

Exploiting SQL Injection in Android's Download Provider (CVE-2019-2198)

Blind SQL injection in Android's Download Provider will retrieve user cookies of downloaded file website (e.g. Gmail).
Patched in November's 2019 Android Security Bulletin.
PoC + info:https://github.com/IOActive/AOSP-DownloadProviderDbDumperSQLiWhere/

GitHub

GitHub - IOActive/AOSP-DownloadProviderDbDumperSQLiWhere: PoC Exploiting SQL Injection in Android's Download Provider in Selection…

PoC Exploiting SQL Injection in Android's Download Provider in Selection Parameter (CVE-2019-2198) - IOActive/AOSP-DownloadProviderDbDumperSQLiWhere

9.67K views08:01

Android Security & Malware

Bruteforce password recovery code for Bumble #iOS app
https://hackerone.com/reports/743545

HackerOne

Bumble disclosed on HackerOne: Bruteforce password recovery code

## Summary
It's possible to bruteforce recovery code from SMS as iOS application doesn't have limits for incorrect inputs. I have tried 50+ different combinations until I reached code from SMS.

##...

👏1

3.81K views09:56

Android Security & Malware