Android Security & Malware

Vulnerabilities across cloud keyboard apps reveal keystrokes to network eavesdroppers (Baidu, Honor, iFlytek, OPPO, Samsung, Tencent, Vivo, and Xiaomi that could be exploited to reveal what a user types)
https://citizenlab.ca/2024/04/vulnerabilities-across-keyboard-apps-reveal-keystrokes-to-network-eavesdroppers/

The Citizen Lab

The not-so-silent type

In this report, we examine cloud-based pinyin keyboard apps from nine vendors (Baidu, Honor, Huawei, iFlyTek, OPPO, Samsung, Tencent, Vivo, and Xiaomi) for vulnerabilities in how the apps transmit user keystrokes. Our analysis found that eight of the nine…

👍13🔥5

10.7K views12:38

👍 23 👎 1

Android Security & Malware

Brokewell: A New Android Banking Trojan Targeting Users In Germany
https://cyble.com/blog/brokewell-a-new-android-banking-trojan-targeting-users-in-germany/

Cyble

Brokewell: New Android Trojan Targeting Germany Users

Cybel uncovers the 'Brokewell' Android Banking Trojan targeting German users with overlay attacks, keylogging, and screen recording. Stay updated on threats.

👍10❤2😁1

10.5K views16:46

👍 15 👎

Android Security & Malware

Security issues in phone-tracking app iSharing exposed users locations
https://www.ericdaigle.ca/isharing-data-leak-writeup/

👍6❤2

10.3K views20:20

👍 21 👎 2

Android Security & Malware

Brokewell: do not go broke from new banking malware
https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware

ThreatFabric

Brokewell: do not go broke from new banking malware!

Explore the new malware family, Brokewell, with Device Takeover capabilities. Understand the risks it poses to financial institutions and how to stay protected.

🔥9👍4

9.2K views09:56

👍 16 👎 1

Android Security & Malware

Advanced Frida Usage Part 9 – Memory Scanning in Android
https://8ksec.io/advanced-frida-usage-part-9-memory-scanning-in-android/

🔥9👍3❤2

14.4K views14:07

👍 20 👎 2

Android Security & Malware

In 2023, Google prevented 2.28 million policy-violating apps from being published on Google Play
https://security.googleblog.com/2024/04/how-we-fought-bad-apps-and-bad-actors-in-2023.html

Google Online Security Blog

How we fought bad apps and bad actors in 2023

Posted by Steve Kafka and Khawaja Shams (Android Security and Privacy Team), and Mohet Saxena (Play Trust and Safety) A safe and trusted ...

❤8😁1

9.05K views16:10

👍 15 👎 10

Android Security & Malware

New Android malware called Wpeeper hides behind hacked WordPress sites
https://blog.xlab.qianxin.com/playing-possum-whats-the-wpeeper-backdoor-up-to/

奇安信 X 实验室

Playing Possum: What's the Wpeeper Backdoor Up To?

Summary

On April 18, 2024, XLab's threat hunting system detected an ELF file with zero detections on VirusTotal being distributed through two different domains. One of the domains was marked as malicious by three security firms, while the other was recently…

❤6🔥4👍1

8.62K views08:10

👍 17 👎 1

Android Security & Malware

“Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps
https://www.microsoft.com/en-us/security/blog/2024/05/01/dirty-stream-attack-discovering-and-mitigating-a-common-vulnerability-pattern-in-android-apps/

Microsoft News

“Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps

Microsoft discovered a vulnerability pattern in multiple popular Android applications that could enable a malicious application to overwrite files in the vulnerable application’s internal data storage directory, which could lead to arbitrary code execution…

🔥10👍2

10.8K views15:55

👍 16 👎

Android Security & Malware

20 Security Issues Found in Xiaomi Devices
https://blog.oversecured.com/20-Security-Issues-Found-in-Xiaomi-Devices/

News, Techniques & Guides

20 Security Issues Found in Xiaomi Devices

👍15😁6🤯4🍓3🙈3

14.7K viewsedited 19:35

👍 29 👎 2

Android Security & Malware

How to Improve Your Android & iOS Static Analysis with Nuclei!
https://medium.com/@justmobilesec/how-to-improve-your-android-ios-static-analysis-with-nuclei-d44f3daa9cee

Medium

How to Improve Your Android & iOS Static Analysis with Nuclei!

TL;DR: In this post, we will cover how to statically analyze Android and iOS applications using Nuclei. We’ll start:

👍12❤3

11.3K views07:50

👍 32 👎 1

Android Security & Malware

Smart-sex-toy users targeted by Android trojan clicker
https://news.drweb.com/show/?i=14860&lng=en

Dr.Web

Smart-sex-toy users targeted by clicker trojan

Virus analysts at Doctor Web uncovered an Android application containing a clicker trojan that silently opens advertising sites and clicks on webpages. Such trojans can be used to stealthily display ads, generate click fraud, sign up unsuspecting victims…

💩21🤡11👍5😁5🗿3😨2

11.4K views12:22

👍 30 👎 6

Android Security & Malware

DNS traffic can leak outside the VPN tunnel on Android
https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the-vpn-tunnel-on-android

Mullvad VPN

DNS traffic can leak outside the VPN tunnel on Android | Mullvad VPN

We were recently made aware of multiple potential DNS leaks on Android. They stem from bugs in Android itself, and only affect certain apps.

👍18😱5

9.95K views08:53

👍 36 👎 5

Android Security & Malware

Finland warns of Vultur Android malware attacks distributed via received SMS messages
https://www.bleepingcomputer.com/news/security/finland-warns-of-android-malware-attacks-breaching-bank-accounts/

BleepingComputer

Finland warns of Android malware attacks breaching bank accounts

Finland's Transport and Communications Agency (Traficom) has issued a warning about an ongoing Android malware campaign targeting banking accounts.

🔥10👍3

10.8K views06:54

👍 15 👎

Android Security & Malware

Guided fuzzing for native Android libraries (using Frida & Radamsa)
https://knifecoat.com/Posts/Coverage+guided+fuzzing+for+native+Android+libraries+(Frida+%26+Radamsa)

KnifeCoat

Coverage guided fuzzing for native Android libraries (Frida & Radamsa) - KnifeCoat

Intro Recently I have been getting into userland application testing on Android. I want to credit Iddo and Jacob for their excellent course on attacking IM Applications which I took at zer0con. As a …

🔥21👍2

14.6K views08:10

👍 26 👎 2

Android Security & Malware

Forwarded from The Bug Bounty Hunter

Flutter Windows Thick Client SSL Pinning Bypass

https://blog.souravkalal.tech/flutter-windows-thick-client-ssl-pinning-bypass-492389ae1218

Medium

Flutter Windows Thick Client SSL Pinning Bypass

I recently worked on a Flutter-based application and learned that it is different from other hybrid frameworks like React Native or…

🔥26👍8❤1

13.1K views06:49

Android Security & Malware

Android Remote Access Trojan Equipped to Harvest Credentials
https://blog.sonicwall.com/en-us/2024/04/android-remote-access-trojan-equipped-to-harvest-credentials/

👍16❤2

11.9K views07:00

👍 26 👎

Android Security & Malware

PoC for CVE-2024-27804, an iOS/macOS kernel vulnerability that leads to the execution of arbitrary code with kernel privileges
https://r00tkitsmm.github.io/fuzzing/2024/05/14/anotherappleavd.html

My interesting research.

CVE-2024-27804 Vulnerability in AppleAVD

https://github.com/R00tkitSMM/CVE-2024-27804

👍19👏3❤1

11.1K views18:09

👍 37 👎 2

About

Blog

Apps

Platform