The simple reality is there are so many 0-day exploits for iOS and the only reason why just a few attacks have been caught in the wild is that iOS phones by design hinder defenders to inspect the phones.
So, if someone says there is no malware on iOS - it's not true - because there is no simple way to prove there was malware.
https://www.vice.com/en_us/article/pajkkz/its-almost-impossible-to-tell-if-iphone-has-been-hacked
So, if someone says there is no malware on iOS - it's not true - because there is no simple way to prove there was malware.
https://www.vice.com/en_us/article/pajkkz/its-almost-impossible-to-tell-if-iphone-has-been-hacked
Vice
It’s Almost Impossible to Tell if Your iPhone Has Been Hacked
A recent vulnerability in WhatsApp shows that there’s little defenders can do to detect and analyze iPhone hacks.
Google Play already scans apps for security issues!
In App Security Improvement program since 2015.
The program has helped more than 300,000 developers to fix more than 1,000,000 apps on Google Play. In 2018 alone, the program helped over 30,000 developers fix over 75,000 apps.
https://developer.android.com/google/play/asi
In App Security Improvement program since 2015.
The program has helped more than 300,000 developers to fix more than 1,000,000 apps on Google Play. In 2018 alone, the program helped over 30,000 developers fix over 75,000 apps.
https://developer.android.com/google/play/asi
Android Developers
App security improvement program | Security | Android Developers
Under the order that will take effect in the coming days, Huawei will need a U.S. government license to buy American technology.
In August, Trump signed a bill that barred the U.S. government itself from using equipment from Huawei and ZTE.
https://www.reuters.com/article/us-usa-china-huaweitech/chinas-huawei-70-affiliates-placed-on-u-s-trade-blacklist-idUSKCN1SL2W4
In August, Trump signed a bill that barred the U.S. government itself from using equipment from Huawei and ZTE.
https://www.reuters.com/article/us-usa-china-huaweitech/chinas-huawei-70-affiliates-placed-on-u-s-trade-blacklist-idUSKCN1SL2W4
Reuters
China's Huawei, 70 affiliates placed on U.S. trade blacklist
WASHINGTON/NEW YORK (Reuters) - The U.S. Commerce Department said on Wednesday it is adding Huawei Technologies Co Ltd and 70 affiliates to its so-called “Entity List” - a move that bans the telecom giant from buying parts and components from U.S. companies…
🤡2
Account takeover prevention
We found that an SMS code sent to a recovery phone number helped block 100% of automated bots, 96% of bulk phishing attacks, and 76% of targeted attacks. On-device prompts, a more secure replacement for SMS, helped prevent 100% of automated bots, 99% of bulk phishing attacks and 90% of targeted attacks.
https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html?m=1
We found that an SMS code sent to a recovery phone number helped block 100% of automated bots, 96% of bulk phishing attacks, and 76% of targeted attacks. On-device prompts, a more secure replacement for SMS, helped prevent 100% of automated bots, 99% of bulk phishing attacks and 90% of targeted attacks.
https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html?m=1
Googleblog
New research: How effective is basic account hygiene at preventing hijacking
Posted by Kurt Thomas and Angelika Moscicki Every day, we protect users from hundreds of thousands of account hijacking attempts. Most at...
Analysis of UC Browser bug that could run unverified code.
Vulnerability in UC Browser could distribute and launch malicious libraries. These libraries will work in the context of the browser, resulting in full system privileges that the browser has.
https://m.habr.com/en/company/drweb/blog/452076/
Vulnerability in UC Browser could distribute and launch malicious libraries. These libraries will work in the context of the browser, resulting in full system privileges that the browser has.
https://m.habr.com/en/company/drweb/blog/452076/
Habr
Breaking UC Browser
Introduction At the end of March we reported on the hidden potential to download and run unverified code in UC Browser. Today we will examine in detail how it...
Google has stopped providing Huawei with hardware and software products.
In other words, while Huawei can still use Android itself, most proprietary services will be inaccessible — including the Google Play Store, Gmail, and presumably anything else that requires the closed-source Play Services Framework.
https://www.androidpolice.com/2019/05/19/huaweis-future-phones-reportedly-wont-have-access-to-google-services-including-the-play-store/
In other words, while Huawei can still use Android itself, most proprietary services will be inaccessible — including the Google Play Store, Gmail, and presumably anything else that requires the closed-source Play Services Framework.
https://www.androidpolice.com/2019/05/19/huaweis-future-phones-reportedly-wont-have-access-to-google-services-including-the-play-store/
Android Police
[Update x3: Official Huawei/Honor statement] Future Huawei phones reportedly won't have access to Google services, including the…
Last week, the United States added Huawei to its 'Entity List', meaning US companies can't do business with Huawei without explicit government approval. A... by Corbin Davenport in Breaking, Google, Huawei, News
🤡1
Android Security & Malware
Google has stopped providing Huawei with hardware and software products. In other words, while Huawei can still use Android itself, most proprietary services will be inaccessible — including the Google Play Store, Gmail, and presumably anything else that requires…
This means that Huawei loses Android updates and all their users access to Google Play Store.
🤡1
Over 19 Android vulnerability reports in one place
https://twitter.com/fs0c131y/status/1129680329994907648
https://twitter.com/fs0c131y/status/1129680329994907648
Twitter
Baptiste Robert
<MEGA THREAD> A lot of people want to start doing security on Android. In my opinion, one of the best way to do it is to read all the fantastic write ups/bug reports made by the community. Can you share in the comments, all the Android articles/write ups/bug…
VidMate - Chinese video app with 500M+ installs is charging people, draining their batteries, and exposing data without their knowledge.
https://www.buzzfeednews.com/article/craigsilverman/vidmate-app-download
https://www.buzzfeednews.com/article/craigsilverman/vidmate-app-download
BuzzFeed News
A Huge Chinese Video App Is Charging People, Draining Their Batteries, And Exposing Data Without Their Knowledge
VidMate told BuzzFeed News it was investigating the claims, but declined to share basic information about its employees and ownership.
👎1
Facebook Messenger Bug in Android
An attacker is able to send media messages on behalf of other users on Facebook Messenger
https://bugreader.com/kbazzoun@sending-message-on-behalf-of-other-users-72
An attacker is able to send media messages on behalf of other users on Facebook Messenger
https://bugreader.com/kbazzoun@sending-message-on-behalf-of-other-users-72
Bugreader
Sending message on behalf of other users
This could have allowed a malicious user to send media messaged on behalf of other users by making them(victims) admins on his page .
Everyone should read this sad story.
Real victim of SIM swapping lost $100K from Coinbase within 24h.
This happened not because of malware, but as a result of sharing too much personal information on social media that end up in intelligence gathering for targeted attack.
https://t.co/Tu1ML9QGDi
Real victim of SIM swapping lost $100K from Coinbase within 24h.
This happened not because of malware, but as a result of sharing too much personal information on social media that end up in intelligence gathering for targeted attack.
https://t.co/Tu1ML9QGDi
Medium
The Most Expensive Lesson Of My Life: Details of SIM port hack
I lost north of $100,000 last Wednesday. It evaporated over a 24 hour timespan in a “SIM port attack” that drained my Coinbase account.
New release of Kali NetHunter 2019.2 (Kali for Android).
NetHunter now supports over 50 devices running all the latest Android versions, from KitKat through to Pie.
https://www.kali.org/news/kali-linux-2019-2-release/
NetHunter now supports over 50 devices running all the latest Android versions, from KitKat through to Pie.
https://www.kali.org/news/kali-linux-2019-2-release/
Kali Linux
Kali Linux 2019.2 Release | Kali Linux Blog
Welcome to our second release of 2019, Kali Linux 2019.2, which is available for immediate download. This release brings our kernel up to version 4.19.28, fixes numerous bugs, includes many updated packages, and most excitingly, features a new release of…
Yesterday was released official version of Tor Browser for Android.
Info: https://www.zdnet.com/article/first-official-version-of-tor-browser-for-android-released-on-the-play-store/
Google Play: https://play.google.com/store/apps/details?id=org.torproject.torbrowser&rdid=org.torproject.torbrowser
For iOS Tor Project recommends: https://itunes.apple.com/us/app/onion-browser/id519296448
Info: https://www.zdnet.com/article/first-official-version-of-tor-browser-for-android-released-on-the-play-store/
Google Play: https://play.google.com/store/apps/details?id=org.torproject.torbrowser&rdid=org.torproject.torbrowser
For iOS Tor Project recommends: https://itunes.apple.com/us/app/onion-browser/id519296448
ZDNET
First official version of Tor Browser for Android released on the Play Store
After eight months of alpha testing, Tor Browser for Android is now ready for rollout.
👍1
Objection - Runtime Mobile Exploration toolkit without need for a jailbroken or rooted mobile device.
Supports iOS & Android while powered by Frida.
https://github.com/sensepost/objection
Supports iOS & Android while powered by Frida.
https://github.com/sensepost/objection
GitHub
GitHub - sensepost/objection: 📱 objection - runtime mobile exploration
📱 objection - runtime mobile exploration. Contribute to sensepost/objection development by creating an account on GitHub.
Phishing "Trezor Mobile Wallet" app found on Google Play and pops as a second search result.
This fake Trezor is also connected to "Coin Wallet" service which was another cryptocurrency wallet on Google Play with over 1,000 installs using same source code and server.
https://www.welivesecurity.com/2019/05/23/fake-cryptocurrency-apps-google-play-bitcoin/
This fake Trezor is also connected to "Coin Wallet" service which was another cryptocurrency wallet on Google Play with over 1,000 installs using same source code and server.
https://www.welivesecurity.com/2019/05/23/fake-cryptocurrency-apps-google-play-bitcoin/
WeLiveSecurity
Fake cryptocurrency apps crop up on Google Play as bitcoin price rises
ESET researchers have analyzed fake cryptocurrency wallets cropping up on Google Play at the time of bitcoin’s renewed growth.