Android Security & Malware

👏7😱4👍3🤔2🥰1

8K views07:52

Bluehat 2023: Android Malware Obfuscation
Overview of multiple Android Malware Obfuscation techniques, along with their implementations and disadvantages
https://youtu.be/Bf-49tgDXW0

YouTube

Bluehat 2023: Android Malware Obfuscation

This is a recording of a quick talk I gave in early 2023 at the Bluehat Security conference. The presentation gives an overview of multiple Android Malware Obfuscation techniques, along with their implementations and disadvantages.

Timestamps:
00:00 Intro…

👍15🔥3

8.43K views11:11

👍 25 👎 1

Android Security & Malware

JADXecute - plugin for JADX that adds Dynamic Code Execution abilities
With JADXecute, you can dynamically run Java code to modify or print components of the jadx-gui output
https://github.com/LaurieWired/JADXecute

GitHub

GitHub - LaurieWired/JADXecute: JADX-gui scripting plugin for dynamic decompiler manipulation

JADX-gui scripting plugin for dynamic decompiler manipulation - LaurieWired/JADXecute

👍16🔥6❤1

8.32K views09:32

👍 23 👎 1

Android Security & Malware

Nexus: a new Android botnet based on SOVA banker
https://www.cleafy.com/cleafy-labs/nexus-a-new-android-botnet

Cleafy

Nexus: a new Android botnet? | Cleafy Labs

A new Android banking trojan might be spreading under the name of Nexus. It is promoted via a MaaS subscription and it contains some relations with an already known SOVA banking trojan. Read the full article to know more about this new player in cybercrime.

👍18❤1

8.87K views14:38

👍 21 👎 1

Android Security & Malware

Near-Ultrasound Inaudible Trojan (NUIT): Exploit smartphone speaker voice assistants with inaudible sound to perform commands
Paper: https://sites.google.com/view/nuitattack/home
Video demo: https://youtu.be/TUnPFR35AR4

Google

NUIT Attack

NUIT-1

👍15

6.93K views07:16

👍 23 👎 1

Android Security & Malware

iMessage and OpenGraph for Fun and Profit
Forge domain name in website preview shared in iMessage app
https://persist.tools/posts/imessage_og.html

👍6❤1

6.82K views09:12

👍 13 👎

Android Security & Malware

XSS vulnerability discovered in Android and iOS WordPress app plugin WPMobile.App (CVE-2023-22702)
https://patchstack.com/database/vulnerability/wpappninja/wordpress-wpmobile-app-android-and-ios-mobile-application-plugin-11-13-cross-site-scripting-xss-vulnerability

Patchstack

WordPress WPMobile.App — Android and iOS Mobile Application plugin <= 11.13 - Cross Site Scripting (XSS) vulnerability - Patchstack

Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.

👍16

7.27K views10:51

👍 29 👎 1

Android Security & Malware

For the first time Windows Ursnif banking trojan campaigns started to target Android users via DroidJack RAT received from email
https://cert--agid-gov-it.translate.goog/news/ursnif-approda-nel-mondo-delle-app-mobile-lapk-droidjack-viene-veicolato-come-comunicazione-agenzia-delle-entrate/?s=03&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en

CERT-AGID

Ursnif approda nel mondo delle app mobile: l’APK DroidJack viene veicolato come comunicazione Agenzia delle Entrate

👍6

6.78K views05:56

👍 11 👎

Android Security & Malware

Chinese Pinduoduo app exploited system vulnerabilities to escalate privileges to download and execute backdoors and gain unauthorized access to user data, notifications and files. The app was also removed from Google Play Store.
Original research: https://mp.weixin.qq.com/s/P_EYQxOEupqdU0BJMRqWsw
Context article: https://krebsonsecurity.com/2023/03/google-suspends-chinese-e-commerce-app-pinduoduo-over-malware/
New analysis report: https://github.com/davincifans101/pinduoduo_backdoor_detailed_report/blob/main/report_en.pdf

👍5❤1

7.41K viewsedited 06:23

👍 16 👎

Android Security & Malware

ARM TrustZone: pivoting to the secure world
https://thalium.github.io/blog/posts/pivoting_to_the_secure_world/

👍8

7.66K views07:44

👍 12 👎 1

Android Security & Malware

Spyware vendors use 0-days and n-days against Android and iOS
https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/

Google

Spyware vendors use 0-days and n-days against popular platforms

Google’s Threat Analysis Group (TAG) tracks actors involved in information operations (IO), government backed attacks and financially motivated abuse. For years, TAG has…

👍8🤔2👏1

8.33K views13:39

👍 28 👎 2

Android Security & Malware

Android GoatRAT Banker Attacks Automated Payment Systems
https://labs.k7computing.com/index.php/goatrat-attacks-automated-payment-systems/

K7 Labs

GoatRAT Attacks Automated Payment Systems

Recently, we came across a detection in our telemetry report named “com.goatmw” which gained our attention. We decided to investigate […]

👍9❤2😁2

8.46K views15:02

👍 22 👎 2

Android Security & Malware

MacStealer: Wi-Fi Client Isolation Bypass
MacStealer can test Wi-Fi networks for client isolation bypasses (CVE-2022-47522) to intercept (steal) traffic toward other clients at the MAC layer
https://github.com/vanhoefm/macstealer

GitHub

GitHub - vanhoefm/macstealer: MacStealer: Wi-Fi Client Isolation Bypass

MacStealer: Wi-Fi Client Isolation Bypass. Contribute to vanhoefm/macstealer development by creating an account on GitHub.

👍12❤3🔥2

8.81K views08:58

👍 19 👎 1

Android Security & Malware

Mobile Pentesting 101 – How to set up your Android Environment
https://securitycafe.ro/2023/04/03/mobile-pentesting-101-how-to-set-up-your-android-environment/

Security Café

Mobile Pentesting 101 – How to set up your Android Environment

This article gives an idea about how your Android pentesting environment should look like. What tools should I use? Do I really need a physical device? Do I need a rooted device to pentest an appli…

👍16❤1👎1

12.1K views07:21

👍 35 👎 2

Android Security & Malware

Android Parcels: Introducing Android's Safer Parcel
https://youtu.be/qIzMKfOmIAA

YouTube

Android Parcels: The Bad, the Good and the Better - Introducing Android's Safer Parcel

Parcel is the serialization mechanism in Android and is behind almost every OS cross-process interaction. Parcelable implementations have been the source of vulnerabilities in Android for ~8 years, often rated high severity and weaponized by malware authors…

👍13❤1

6.56K views06:18

👍 10 👎 1

Android Security & Malware

Set Up an Android Hacking Lab for $0
https://www.trustedsec.com/blog/set-up-an-android-hacking-lab-for-0/

TrustedSec

Set Up an Android Hacking Lab for $0

Prerequisites: Python3 - https://www.python.org/downloads/ Android Studio - https://developer.android.com/studio Android Platform-Tools -…

👍22

10.9K views11:52

Android Security & Malware

Moqhao (Shaoye aka XLoader) malware operated by Yanbian group can bypass text-based CAPTCHAs #RoamingMantis
This feature is used in combination with brute-force attacks on wireless router’s web interfaces to compromise routers and perform DNS hijacking attacks.
https://www.telekom.com/en/blog/group/article/moqhao-masters-new-tricks-1031484

Telekom

Moqhao masters new tricks

News from the Moqhao malware family. It attacks Android smartphones and has now even learned to overcome CAPTCHA.

👍12😨2🤔1

6.53K views12:46

👍 14 👎 1

Android Security & Malware

How to intercept network trafic on Android
https://github.com/LabCIF-Tutorials/Tutorial-AndroidNetworkInterception

GitHub

GitHub - LabCIF-Tutorials/Tutorial-AndroidNetworkInterception: How to intercept network trafic on Android

How to intercept network trafic on Android. Contribute to LabCIF-Tutorials/Tutorial-AndroidNetworkInterception development by creating an account on GitHub.

👍19