Delving into Dalvik: A Look Into DEX Files
https://www.mandiant.com/resources/blog/dalvik-look-into-dex-files
https://www.mandiant.com/resources/blog/dalvik-look-into-dex-files
Google Cloud Blog
Delving into Dalvik: A Look Into DEX Files | Google Cloud Blog
Insight into the Dalvik Executable file format, how it is constructed, and how it can be altered to make analysis easier.
👍14❤3
Forwarded from The Bug Bounty Hunter
Code injection on Android without ptrace
https://erfur.github.io/blog/dev/code-injection-without-ptrace
https://erfur.github.io/blog/dev/code-injection-without-ptrace
erfur's bits and pieces
Code injection on Android without ptrace
👍20❤1
Analysis of an Android Malware-as-a-Service Operation (Coper aka Octo banking Trojan)
https://www.team-cymru.com/post/coper-octo-a-conductor-for-mobile-mayhem-with-eight-limbs
https://www.team-cymru.com/post/coper-octo-a-conductor-for-mobile-mayhem-with-eight-limbs
Team-Cymru
Coper / Octo - A Conductor for Mobile Mayhem | Team Cymru
Explore Coper/Octo, an Android malware-as-a-service evolved from Exobot, targeting users globally with remote access, keylogging, and SMS interception. Contact us.
👍16🎉4
Analyze Android apps for security risks in Termux using APKDeepLens
-analyze downloaded or installed apps on device
-scan APKs on the go
-edit the script for custom needs
-works on any non-rooted Android
https://www.mobile-hacker.com/2024/03/11/analyze-installed-android-applications-for-security-risks-in-termux/
-analyze downloaded or installed apps on device
-scan APKs on the go
-edit the script for custom needs
-works on any non-rooted Android
https://www.mobile-hacker.com/2024/03/11/analyze-installed-android-applications-for-security-risks-in-termux/
Mobile Hacker
Analyze installed Android applications for security risks in Termux
I will show you how to install and run it on non-rooted Android device using Termux app. This brings convenience of analyzing Android apps directly on device
👍15
Attack spectrum present in Android environments
https://blog.devsecopsguides.com/attacking-android
https://blog.devsecopsguides.com/attacking-android
Devsecopsguides
Attacking Android
In this comprehensive guide, we delve into the world of Android security from an offensive perspective, shedding light on the various techniques and methodologies used by attackers to compromise Android devices and infiltrate their sensitive data.
👍10🥱8
The State of Stalkerware in 2023
https://securelist.com/state-of-stalkerware-2023/112135/
Full report: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/03/07160820/The-State-of-Stalkerware-in-2023.pdf
https://securelist.com/state-of-stalkerware-2023/112135/
Full report: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/03/07160820/The-State-of-Stalkerware-in-2023.pdf
Securelist
Kaspersky 2023 report on stalkerware
In this report, Kaspersky shares statistics on stalkerware detections, as well as insights into the impact of digital stalking in 2023 and the beginning of 2024, and advice for those affected.
👍8
Write-up and PoC kernel exploit affecting Pixel 7/8 Pro running Android 14 targeting Mali GPU
https://github.com/0x36/Pixel_GPU_Exploit
https://github.com/0x36/Pixel_GPU_Exploit
GitHub
GitHub - 0x36/Pixel_GPU_Exploit: Android 14 kernel exploit for Pixel7/8 Pro
Android 14 kernel exploit for Pixel7/8 Pro. Contribute to 0x36/Pixel_GPU_Exploit development by creating an account on GitHub.
😱12👍6
LTair: The LTE Air Interface Tool
https://research.nccgroup.com/2024/03/14/ltair-the-lte-air-interface-tool/
https://research.nccgroup.com/2024/03/14/ltair-the-lte-air-interface-tool/
Nccgroup
Cyber Security Research
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
🔥25👍3
Android Phishing Scam Using Malware-as-a-Service on the Rise in India
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/android-phishing-scam-using-malware-as-a-service-on-the-rise-in-india/
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/android-phishing-scam-using-malware-as-a-service-on-the-rise-in-india/
McAfee Blog
Android Phishing Scam Using Malware-as-a-Service on the Rise in India | McAfee Blog
Authored by ZePeng Chen and Wenfeng Yu McAfee Mobile Research Team has observed an active scam malware campaign targeting Android users in India. This
👍12
A vulnerability (CVE-2023-6241) in the Arm Mali GPU to gain arbitrary kernel code execution from an untrusted app on a Pixel 8 with MTE enabled
https://github.blog/2024-03-18-gaining-kernel-code-execution-on-an-mte-enabled-pixel-8/
https://github.blog/2024-03-18-gaining-kernel-code-execution-on-an-mte-enabled-pixel-8/
The GitHub Blog
Gaining kernel code execution on an MTE-enabled Pixel 8
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulnerability can be exploited even when Memory Tagging Extension…
👍9
Analysis of suspicious SMS that leads to install Android malware
https://labs.k7computing.com/index.php/suspicious-text-messages-alert/
https://labs.k7computing.com/index.php/suspicious-text-messages-alert/
K7 Labs
Suspicious Text Messages Alert
Cybercriminals are targeting the users with sophisticated fake apps that can steal your hard-earned money. These messages can appear convincingly […]
🔥10👍3
The complexity of reversing Flutter applications
https://www.fortiguard.com/events/5403/nullcon-berlin-2024-the-complexity-of-reversing-flutter-applications
[slides] https://filestore.fortinet.com/fortiguard/research/nullcon.pdf
https://www.fortiguard.com/events/5403/nullcon-berlin-2024-the-complexity-of-reversing-flutter-applications
[slides] https://filestore.fortinet.com/fortiguard/research/nullcon.pdf
FortiGuard Labs
Publications | FortiGuard Labs
Flutter is a cross-platform application development platform. With the same codebase, developers write and compile native applications for Android,...
👍9
[Questionnaire] We are writing here to get some insights from dedicated malware analysis experts. We are a group of experienced researchers, and we developed a state-of-the-art sandbox for Android malware. We are absolutely convinced that it makes sense to bring this technology to the market, but we need to picture your biggest sandbox needs in your daily work. The idea is to grasp what are, in your eyes, the must-haves of a sandbox. Our goal is to shape the product accordingly and make it available in the forthcoming months/next few months. To this end, we prepared a quick (approximately 15-minutes) questionnaire, and it would really mean a lot to us if you could share your valuable feedback. Thanks to this, we hope to offer you soon a gain of efficiency, time and energy in your job.
Questionnaire: https://forms.gle/qJ9ck8UH5WQK6jAZ8
Questionnaire: https://forms.gle/qJ9ck8UH5WQK6jAZ8
Google Docs
Android Sandboxes: Malware Analysts' Expectations & Needs
Hello!
Thank you very much for taking the time to answer this survey. We really appreciate it!
We are a group of security researchers developing a new Android malware sandbox.
Our objective is to understand what you, as a security professional, expect from…
Thank you very much for taking the time to answer this survey. We really appreciate it!
We are a group of security researchers developing a new Android malware sandbox.
Our objective is to understand what you, as a security professional, expect from…
🔥13👍4❤3🥰2👏1
Android crimeware reports on Tambir, Dwphon and Gigabud malware families
https://securelist.com/crimeware-report-android-malware/112121/
https://securelist.com/crimeware-report-android-malware/112121/
Securelist
Kaspersky crimeware report: Android malware
In this report, we share our latest Android malware findings: the Tambir spyware, Dwphon downloader and Gigabud banking Trojan.
👍12🤔1
Oversecured published vulnerability scan reports for 225 Google-owned apps
https://blog.oversecured.com/Oversecured-Apps-Care-Part-1-Vulnerability-disclosure-of-225-Google-apps/
https://blog.oversecured.com/Oversecured-Apps-Care-Part-1-Vulnerability-disclosure-of-225-Google-apps/
News, Techniques & Guides
Oversecured Apps Care. Part 1: Vulnerability disclosure of 225 Google apps
❤16👍2
Bluetooth vulnerability allows unauthorized user to record & play audio on Bluetooth speaker via #BlueSpy
Prevention section explains how you can check if your Bluetooth LE speakers/headsets are vulnerable to this attack using nRF Connect app
https://www.mobile-hacker.com/2024/03/22/bluetooth-vulnerability-allows-unauthorized-user-to-record-and-play-audio-on-bluetooth-speakers/
Prevention section explains how you can check if your Bluetooth LE speakers/headsets are vulnerable to this attack using nRF Connect app
https://www.mobile-hacker.com/2024/03/22/bluetooth-vulnerability-allows-unauthorized-user-to-record-and-play-audio-on-bluetooth-speakers/
Mobile Hacker
Bluetooth vulnerability allows unauthorized user to record and play audio on Bluetooth speakers
This critical security issue allows third party user to record audio from Bluetooth speaker with built-in microphone in vicinity, even when it is already paired and connected with another device. This can result in eavesdropping on private conversations using…
👏16👍8❤2
SSRF in Mobile Security Framework (MobSF) version 3.9.5 Beta and prior (CVE-2024-29190)
MobSF does not perform any input validation when extracting the hostnames in
https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3
MobSF does not perform any input validation when extracting the hostnames in
android:host, so requests can also be sent to local hostnames. This can lead to server-side request forgery (SSRF). An attacker can cause the server to make a connection to internal-only services within the organization's infrastructurehttps://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3
GitHub
SSRF Vulnerability on assetlinks_check(act_name, well_knowns)
### Summary
While examining the "App Link assetlinks.json file could not be found" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET requ...
While examining the "App Link assetlinks.json file could not be found" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET requ...
👍9❤1
BlueDucky automates exploitation of Bluetooth pairing vulnerability that leads to 0-click code execution
▪️automatically scans for devices
▪️store MAC addresses of devices that are no longer visible but have enabled Bluetooth
▪️uses Rubber Ducky payloads
https://www.mobile-hacker.com/2024/03/26/blueducky-automates-exploitation-of-bluetooth-pairing-vulnerability-that-leads-to-0-click-code-execution/
▪️automatically scans for devices
▪️store MAC addresses of devices that are no longer visible but have enabled Bluetooth
▪️uses Rubber Ducky payloads
https://www.mobile-hacker.com/2024/03/26/blueducky-automates-exploitation-of-bluetooth-pairing-vulnerability-that-leads-to-0-click-code-execution/
Mobile Hacker
BlueDucky automates exploitation of Bluetooth pairing vulnerability that leads to 0-click code execution
BlueDucky solves the problem of auto device discovery, locally stores found Bluetooth devices and utilized Rubber Ducky scripts that are injected from separated
👍14🔥5❤3
Detecting Banker Malware Installed on Android Devices
https://itnext.io/detecting-banker-malware-installed-on-android-devices-4c96287138e2
https://itnext.io/detecting-banker-malware-installed-on-android-devices-4c96287138e2
Medium
Detecting Banker Malware Installed on Android Devices
This article presents mechanisms and ideas for detecting malicious applications installed on Android devices that abuse the…
👍13
Address Sanitizer for Bare-metal Firmware
This led to early discovery of memory corruption issues that were easily remediated due to the actionable reports produced by KASan. These builds can be used with fuzzers to detect edge case bugs
https://security.googleblog.com/2024/03/address-sanitizer-for-bare-metal.html
This led to early discovery of memory corruption issues that were easily remediated due to the actionable reports produced by KASan. These builds can be used with fuzzers to detect edge case bugs
https://security.googleblog.com/2024/03/address-sanitizer-for-bare-metal.html
Google Online Security Blog
Address Sanitizer for Bare-metal Firmware
Posted by Eugene Rodionov and Ivan Lozano, Android Team With steady improvements to Android userspace and kernel security, we have notice...
👍8
Malicious proxy malware was found in 28 apps available on Google Play Store. These trojanized apps were overall installed over 3,240,000 times
https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-proxylib-and-lumiapps-transform-mobile-devices-into-proxy-nodes
https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-proxylib-and-lumiapps-transform-mobile-devices-into-proxy-nodes
HUMAN Security
Satori Threat Intelligence Alert: PROXYLIB and LumiApps Transform Mobile Devices into Proxy Nodes - HUMAN Security
HUMAN's Satori Threat Intelligence team uncovered a group of 28 apps that turned user devices into residential proxy nodes.
👍4😱3🥱3👎2🔥2❤1👏1