Bypass PIN codes for Visa contactless payments
A successful attack requires four components: (1+2) two Android smartphones, (3) a special Android app developed by the research team, and (4) a Visa contactless card.
The entire idea behind the attack is that the POS emulator asks the card to make a payment, modifies transaction details, and then sends the modified data via WiFi to the second smartphone that makes a large payment without needing to provide a PIN (as the attacker has modified the transaction data to say that the PIN is not needed).
Info: https://www.zdnet.com/article/academics-bypass-pins-for-visa-contactless-payments/
Research: https://arxiv.org/pdf/2006.08249.pdf
Video demo: https://youtu.be/JyUsMLxCCt8
A successful attack requires four components: (1+2) two Android smartphones, (3) a special Android app developed by the research team, and (4) a Visa contactless card.
The entire idea behind the attack is that the POS emulator asks the card to make a payment, modifies transaction details, and then sends the modified data via WiFi to the second smartphone that makes a large payment without needing to provide a PIN (as the attacker has modified the transaction data to say that the PIN is not needed).
Info: https://www.zdnet.com/article/academics-bypass-pins-for-visa-contactless-payments/
Research: https://arxiv.org/pdf/2006.08249.pdf
Video demo: https://youtu.be/JyUsMLxCCt8
ZDNET
Academics bypass PINs for Visa contactless payments
Researchers: "In other words, the PIN is useless in Visa contactless transactions."
Transparent Tribe: Evolution analysis
Part 1: https://securelist.com/transparent-tribe-part-1/98127/
Part 2 (Android): https://securelist.com/transparent-tribe-part-2/98233/
Part 1: https://securelist.com/transparent-tribe-part-1/98127/
Part 2 (Android): https://securelist.com/transparent-tribe-part-2/98233/
Securelist
Transparent Tribe: Evolution analysis, part 1 | Securelist
Transparent Tribe, also known as PROJECTM and MYTHIC LEOPARD, is a highly prolific group whose activities can be traced as far back as 2013.
Persistent arbitrary code execution in Android's Google Play Core Library: details, explanation and the PoC - CVE-2020-8913
https://blog.oversecured.com/Oversecured-automatically-discovers-persistent-code-execution-in-the-Google-Play-Core-Library/
https://blog.oversecured.com/Oversecured-automatically-discovers-persistent-code-execution-in-the-Google-Play-Core-Library/
News, Techniques & Guides
Oversecured automatically discovers persistent code execution in the Google Play Core Library
The Google Play Core Library is a popular library for Android that allows updates to various parts of an app to be delivered at runtime without the participation of the user, via the Google API...
TERRACOTTA Android Malware: A Technical Study
https://www.whiteops.com/blog/terracotta-android-malware-a-technical-study
https://www.whiteops.com/blog/terracotta-android-malware-a-technical-study
HUMAN Security
TERRACOTTA Android Malware: A Technical Study - HUMAN Security
The Satori Threat Intelligence & Research Team takes a deep dive into the TERRACOTTA ad fraud operation and its sophistication.
Forwarded from The Bug Bounty Hunter
GitHub
GitHub - Soulghost/iblessing: iblessing is an iOS security exploiting toolkit, it mainly includes application information gathering…
iblessing is an iOS security exploiting toolkit, it mainly includes application information gathering, static analysis and dynamic analysis. It can be used for reverse engineering, binary analysis ...
ThiefBot: A New Android Banking Trojan Targeting Turkish Banking Users
https://business.xunison.com/thiefbot-a-new-android-banking-trojan-targeting-turkish-banking-users/
https://business.xunison.com/thiefbot-a-new-android-banking-trojan-targeting-turkish-banking-users/
Google removes Android app that was used to spy on Belarusian protesters
https://www.zdnet.com/article/google-removes-android-app-that-was-used-to-spy-on-belarusian-protesters/
https://www.zdnet.com/article/google-removes-android-app-that-was-used-to-spy-on-belarusian-protesters/
ZDNet
Google removes Android app that was used to spy on Belarusian protesters
App mimicked a popular anti-government news site and collected location and device owner details.
Mobile threat statistics for Q2 2020 by Kaspersky
https://securelist.com/it-threat-evolution-q2-2020-mobile-statistics/98337/
https://securelist.com/it-threat-evolution-q2-2020-mobile-statistics/98337/
Securelist
IT threat evolution Q2 2020. Mobile statistics
According to Kaspersky Security Network, during the second quarter 1,245,894 malicious installers were detected and a total of 14,204,345 attacks on mobile devices were blocked.
India yesterday banned 118 Chinese apps
List of app in the link
https://drive.google.com/file/d/1NRcC49uKIvwA4-sDmubC5aC2LmHggKoG/view
List of app in the link
https://drive.google.com/file/d/1NRcC49uKIvwA4-sDmubC5aC2LmHggKoG/view
Android Permission (Notification Permission) Can Be Lethal [Android Malware Series]
https://youtu.be/PzhDEV7rpP0
https://youtu.be/PzhDEV7rpP0
YouTube
This Android Permission Can Be Lethal. [Android Malware Series]
In this video, I talk about how this Android Permission (Notification Permission) can steal almost all private data from victim's device without asking for any extra permission.
Many Android Malware uses this permission to perform various tasks like stealing…
Many Android Malware uses this permission to perform various tasks like stealing…
WhatsApp discloses six previously undisclosed flaws
https://www.whatsapp.com/security/advisories/2020/
https://www.whatsapp.com/security/advisories/2020/
WhatsApp.com
WhatsApp Security Advisories 2020
WhatsApp Security Advisories 2020 - List of security fixes for WhatsApp products
ARM64 Reversing and Exploitation
Part 1: http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/
Part 2: http://highaltitudehacks.com/2020/09/06/arm64-reversing-and-exploitation-part-2-use-after-free/
Part 3: http://highaltitudehacks.com/2020/09/06/arm64-reversing-and-exploitation-part-3-a-simple-rop-chain/
Part 1: http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/
Part 2: http://highaltitudehacks.com/2020/09/06/arm64-reversing-and-exploitation-part-2-use-after-free/
Part 3: http://highaltitudehacks.com/2020/09/06/arm64-reversing-and-exploitation-part-3-a-simple-rop-chain/
Prateekg147
ARM64 Reversing and Exploitation Part 1 - ARM Instruction Set + Simple Heap Overflow
Hi Everyone ! In this blog series, we will be understanding the ARM instruction set and using that to reverse ARM Binaries followed by writing exploits for them. So let’s start with the basics of ARM64.
TikTok Spyware (SpyNote) Analysis
https://www.zscaler.com/blogs/research/tiktok-spyware
https://www.zscaler.com/blogs/research/tiktok-spyware
Zscaler
Detailed Analysis of TikTok Spyware | Zscaler Blog
Recently, Zscaler analyzed another variant of this app portraying itself as TikTok Pro, but its a spyware with premium features to spy on victim with ease.
Android bypass SSL pinning using Frida
https://www.docdroid.net/file/download/zokUC70/android-ssl-pinning-pdf.pdf
https://www.docdroid.net/file/download/zokUC70/android-ssl-pinning-pdf.pdf
Three persistent and one theft of arbitrary files vulnerabilities have been discovered in the TikTok Android app
https://blog.oversecured.com/Oversecured-detects-dangerous-vulnerabilities-in-the-TikTok-Android-app/
https://blog.oversecured.com/Oversecured-detects-dangerous-vulnerabilities-in-the-TikTok-Android-app/
News, Techniques & Guides
Oversecured detects dangerous vulnerabilities in the TikTok Android app
Oversecured has once again uncovered high-severity vulnerabilities, this time in the TikTok app. The app contained one vulnerability to theft of arbitrary files with user interaction and three to persistent arbitrary code execution.
Billions of devices vulnerable to new 'BLESA' Bluetooth security flaw
https://www.zdnet.com/google-amp/article/billions-of-devices-vulnerable-to-new-blesa-bluetooth-security-flaw/
https://www.zdnet.com/google-amp/article/billions-of-devices-vulnerable-to-new-blesa-bluetooth-security-flaw/
ZDNET
Billions of devices vulnerable to new 'BLESA' Bluetooth security flaw
New BLESA attack goes after the often ignored Bluetooth reconnection process, unlike previous vulnerabilities, most found in the pairing operation.
Vulnerability that allows to persistently launch Intent on every device on the same LAN that had vulnerable version of Firefox for Android (68.11.0 and below)
Report: https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/red-team-tech-notes/-/tree/master/firefox-android-2020
PoC code: https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/red-team-tech-notes/-/blob/master/firefox-android-2020/ffssdp.py
Report: https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/red-team-tech-notes/-/tree/master/firefox-android-2020
PoC code: https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/red-team-tech-notes/-/blob/master/firefox-android-2020/ffssdp.py
GitLab
firefox-android-2020 · master · GitLab.com / GitLab Security Division / Security Operations Department / Red Team / Red Team Public…
As we come across interesting things that we want to share with the community we will document them here as a tech note.