The #RoamingMantis group targets Android and iOS devices (phishing Apple ID) in Europe #FakeCop
https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681
https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681
Medium
The RoamingMantis Group’s Expansion to European Apple Accounts and Android Devices
Background
iOS/MacOS wifi proximity kernel double free in AWDL BSS Steering
https://bugs.chromium.org/p/project-zero/issues/detail?id=2012
https://bugs.chromium.org/p/project-zero/issues/detail?id=2012
TikTok Secretly Spying On Clipboard of Millions iPhone Users
https://www.forbes.com/sites/zakdoffman/2020/06/26/warning-apple-suddenly-catches-tiktok-secretly-spying-on-millions-of-iphone-users/amp/
https://www.forbes.com/sites/zakdoffman/2020/06/26/warning-apple-suddenly-catches-tiktok-secretly-spying-on-millions-of-iphone-users/amp/
Forbes
Warning—Apple Suddenly Catches TikTok Secretly Spying On Millions Of iPhone Users
If you are a TikTok user, you should be worried—here's what you need to know.
Android malware detection based on image-based features and machine learning techniques
https://link.springer.com/article/10.1007/s42452-020-3132-2
https://link.springer.com/article/10.1007/s42452-020-3132-2
SpringerLink
Android malware detection based on image-based features and machine learning techniques
SN Applied Sciences - In this paper, a malware classification model has been proposed for detecting malware samples in the Android environment. The proposed model is based on converting some files...
Debugging the Samsung Android Kernel
Part 1: https://blog.pucarasec.com/2020/06/09/debugging-the-samsung-android-kernel-part-1/
Part 2: https://blog.pucarasec.com/2020/06/16/debugging-the-samsung-android-kernel-part-2/
Part 3: https://blog.pucarasec.com/2020/06/23/debugging-the-samsung-android-kernel-part-3/
Part 1: https://blog.pucarasec.com/2020/06/09/debugging-the-samsung-android-kernel-part-1/
Part 2: https://blog.pucarasec.com/2020/06/16/debugging-the-samsung-android-kernel-part-2/
Part 3: https://blog.pucarasec.com/2020/06/23/debugging-the-samsung-android-kernel-part-3/
Posts by Pucara Information Security Team
Debugging the Samsung Android Kernel part 1:
Compiling a custom Samsung Android Kernel, and living to tell the tale. Many security enthusiasts and sysadmins are familiar with the process in which one custom compiles a Linux Kernel and th…
Forwarded from The Bug Bounty Hunter
Android App Source code Extraction and Bypassing Root and SSL Pinning checks
https://vj0shii.github.io/android-app-testing-initial-steps/
https://vj0shii.github.io/android-app-testing-initial-steps/
vj0shii.github.io
Android App Source code Extraction and Bypassing Root and SSL Pinning checks
In this blog I will be describing the pre-requesty steps I followed for one of the android application penetration testing
SafetyNet’s dreaded hardware attestation is rolling out, making it much harder for Magisk to hide root
https://www.xda-developers.com/safetynet-hardware-attestation-hide-root-magisk/
https://www.xda-developers.com/safetynet-hardware-attestation-hide-root-magisk/
XDA
SafetyNet's dreaded hardware attestation is rolling out, making it much harder for Magisk to hide root
Hiding root access in Magisk is about to become a whole lot harder to do thanks to a recent change in SafetyNet bringing hardware attestation.
Android 11
Privacy updates:
•Auto-reset permissions from unused apps!
•Package visibility: can't list installed apps!
•New, clearer permission to obtain user phone number!
•One-time permissions (temp granted permissions)
•Background location access
•Scoped Storage
https://developer.android.com/preview/privacy
Privacy updates:
•Auto-reset permissions from unused apps!
•Package visibility: can't list installed apps!
•New, clearer permission to obtain user phone number!
•One-time permissions (temp granted permissions)
•Background location access
•Scoped Storage
https://developer.android.com/preview/privacy
Android Developers
Privacy in Android 11 | Platform | Android Developers
Read about the privacy changes in Android 11 and learn how to support them in your apps.
Intercept & view all Android HTTP(S)
Mock endpoints or entire servers
Rewrite, redirect, or inject errors
https://httptoolkit.tech/android
Mock endpoints or entire servers
Rewrite, redirect, or inject errors
https://httptoolkit.tech/android
Httptoolkit
Intercept, mock & debug Android HTTP traffic
HTTP Toolkit includes built-in automatic setup and advanced support for Android, so you can debug and modify any HTTP(S) traffic in seconds.
Clipboard Toast
An Xposed module that notifies you whenever an app reads your clipboard
https://github.com/ubuntuegor/ClipboardToast
An Xposed module that notifies you whenever an app reads your clipboard
https://github.com/ubuntuegor/ClipboardToast
GitHub
GitHub - ubuntuegor/ClipboardToast: Clipboard access notification inspired by iOS 14
Clipboard access notification inspired by iOS 14. Contribute to ubuntuegor/ClipboardToast development by creating an account on GitHub.
Package visibility in Android 11 #ForDevelopers
https://medium.com/androiddevelopers/package-visibility-in-android-11-cc857f221cd9
https://medium.com/androiddevelopers/package-visibility-in-android-11-cc857f221cd9
Medium
Package visibility in Android 11
On Android 10 and earlier, apps could query the full list of installed apps on the system using methods like queryIntentActivities. In…
Android FakeSpy analysis | Roaming Mantis
https://www.cybereason.com/blog/fakespy-masquerades-as-postal-service-apps-around-the-world
https://www.cybereason.com/blog/fakespy-masquerades-as-postal-service-apps-around-the-world
Cybereason
FakeSpy Masquerades as Postal Service Apps Around the World
The Cybereason Nocturnus team is investigating a new campaign involving FakeSpy, an Android mobile malware used to steal SMS messages, send SMS messages, steal financial data, read account information and contact lists, steal application data, and do much…
Multiyear Surveillance Campaigns Discovered Targeting Uyghurs | mAPT | SilkBean| DoubleAgent CarbonSteal | GoldenEagle
https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf
https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf
Popular Android malware threats - Jun, 2020
Full list: http://skptr.me/malware_timeline_2020.html
Download samples: https://github.com/sk3ptre/AndroidMalware_2020
Full list: http://skptr.me/malware_timeline_2020.html
Download samples: https://github.com/sk3ptre/AndroidMalware_2020
GitHub
GitHub - sk3ptre/AndroidMalware_2020: Popular Android malware seen in 2020
Popular Android malware seen in 2020. Contribute to sk3ptre/AndroidMalware_2020 development by creating an account on GitHub.
LinkedIn iOS app is copying the contents every clipboard keystroke. IOS 14 allows users to see each paste notification
https://www.zdnet.com/article/linkedin-says-ios-clipboard-snooping-after-every-key-press-is-a-bug-will-fix/
https://www.zdnet.com/article/linkedin-says-ios-clipboard-snooping-after-every-key-press-is-a-bug-will-fix/
ZDNet
LinkedIn says iOS clipboard snooping after every key press is a bug, will fix
The new clipboard access detection and warning feature in iOS 14 exposes another app.
Android Keylogger Injector demo
Be aware of such techniques when downloading any app, because free tutorial how to create keylogger injector is available on underground forums
https://youtu.be/jpmUUuNUIfo
Be aware of such techniques when downloading any app, because free tutorial how to create keylogger injector is available on underground forums
https://youtu.be/jpmUUuNUIfo
MobOk Malware found on Google Play
Functionality:
-Switching from Wi-Fi to Data Connection
-Subscribing to premium mobile services
-Solving Image-based CAPTCHA using an external image recognition service
-Stealing SMS used for 2FA
-Using the accessibility services to carry-on malicious activities on the screen
https://blog.zimperium.com/zimperium-discovers-mobok-malware-left-undetected-by-mobile-av-industry-for-months/
Functionality:
-Switching from Wi-Fi to Data Connection
-Subscribing to premium mobile services
-Solving Image-based CAPTCHA using an external image recognition service
-Stealing SMS used for 2FA
-Using the accessibility services to carry-on malicious activities on the screen
https://blog.zimperium.com/zimperium-discovers-mobok-malware-left-undetected-by-mobile-av-industry-for-months/
Zimperium
Zimperium Discovers MobOk Malware Left Undetected by AV Industry for Months - Zimperium
zLabs researchers have uncovered a new variant of the MobOk campaign. The samples found evaded detection by AV vendors for months. Zimperium worked with
Police cracked encryption in EncroChat to read messages between drug criminals, hitmen and murder orders
https://www.nytimes.com/2020/07/02/world/europe/encrypted-network-arrests-europe.html
https://www.nytimes.com/2020/07/02/world/europe/encrypted-network-arrests-europe.html
NY Times
When Police Are Hackers: Hundreds Charged as Encrypted Network Is Broken
The authorities said that by hacking into EncroChat, they were able to monitor criminal activity in real time, allowing them to stop drug deals and even murder.
How to use #Frida and #BurpSuite to quickly identify mobile app functionality
https://youtu.be/07K5DZXMvB4
https://youtu.be/07K5DZXMvB4
YouTube
How to identify malware using dynamic analysis tools | Android Trojan Spy | Burp Suite | Frida
Only by using dynamic analysis tools you can quickly identify mobile app functionality.
Demonstration of Android Trojan Spy functionality using dynamic tools Burp Suite and Frida to identify how it exfiltrates personal user data.
This Android malicious app…
Demonstration of Android Trojan Spy functionality using dynamic tools Burp Suite and Frida to identify how it exfiltrates personal user data.
This Android malicious app…
Repairing your smartphone or installing a ROM now will be a crime in Mexico
https://www.xataka.com.mx/legislacion-y-derechos/reparar-tu-smartphone-instalarle-rom-sera-delito-mexico-nueva-ley-que-proteje-candados-digitales-explicada
https://www.xataka.com.mx/legislacion-y-derechos/reparar-tu-smartphone-instalarle-rom-sera-delito-mexico-nueva-ley-que-proteje-candados-digitales-explicada
Xataka México
Reparar tu smartphone o instalarle una ROM será delito en México: la nueva ley que protege los candados digitales, explicada
Instalar una ROM personalizada, descargar y usar software que no provenga del mismo proveedor, y hasta reparar un teléfono, pasa por romper un candado digital...